CVE-2017-18035

Name: CVE-2017-18035
Creator: NVD / NIST
Published: 2018-02-02T14:29:00.607+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.80%

Last modified Jun 17, 2026

CVE-2017-18035 is a vulnerability of currently unknown severity. The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics for it.. EPSS estimates a 0.80% chance of exploitation in the next 30 days.

Description

The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics for it.

Metrics

EPSS Probability

0.80%

52.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Atlassian	Fisheye	< 4.5.1
Atlassian	Crucible	< 4.5.1

References

https://jira.atlassian.com/browse/CRUC-8163Vendor Advisory
https://jira.atlassian.com/browse/FE-6996Vendor Advisory
https://jira.atlassian.com/browse/CRUC-8163Vendor Advisory
https://jira.atlassian.com/browse/FE-6996Vendor Advisory

Timeline

Published: Feb 2, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-18035?

How severe is CVE-2017-18035?

Severity scoring for CVE-2017-18035 is pending analysis. The EPSS model estimates a 0.80% probability of exploitation in the next 30 days.

How do I fix CVE-2017-18035?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-18035?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST