This advisory details a critical security vulnerability that we have found in Crucible and fixed in recent versions of Crucible.

• Customers who have downloaded and installed Crucible should upgrade their existing Crucible installations to fix this vulnerability.  
• Atlassian OnDemand customers are not affected because OnDemand does not include Crucible.

The vulnerability affects all versions of Crucible up to and including 3.1.5 and 2.10.7.

アトラシアンは製品セキュリティの向上に取り組んでいます。当社では脆弱性の報告を完全にサポートしており、問題の特定と解決に対する皆様の協力に感謝しています。

このアドバイザリに関してご質問や懸念がある場合は、https://support.atlassian.com でサポート リクエストを起票してください。

ユーザー権限のエスカレーション

深刻度

Atlassian rates the severity level of this vulnerability as critical, according to the scale published in https://www.atlassian.com/security. The scale allows us to rank the severity as critical, high, moderate or low.

This is an independent assessment and you should evaluate its applicability to your own IT environment.

説明

We have identified and fixed a vulnerability in Crucible which allowed unauthenticated users to commit actions on behalf of any other authorised user. In order to exploit this vulnerability, an attacker requires access to your Crucible web interface. 

A Crucible server is only vulnerable if it has been configured to be a part of an Application link with Trusted Applications authentication. Unless you chose OAuth authentication when configuring previously created links, Trusted Applications was used by default.

The vulnerability affects all supported versions of Crucible up to and including 3.1.5 and 2.10.7. It has been fixed in 3.2.0, 3.1.6 and 2.10.8. The issue is tracked in  CRUC-6662 - Getting issue details... STATUS .  

Risk Mitigation

If you are unable to upgrade your Crucible server you can do the following as a temporary workaround:

• Block access to your Crucible server web interface from untrusted networks, such as the Internet.
• Remove any Application links that use Trusted Applications authentication and re-create them using OAuth.

修正

This vulnerability can be fixed by upgrading Crucible. If you have any questions, please raise a support request at http://support.atlassian.com. We recommend upgrading.

The Security Patch Policy describes when and how we release security patches and security upgrades for our products.  Only security upgrades are released for Crucible. Patches are not released for Crucible.

Upgrading Crucible

Upgrade to Crucible 3.2.0, 3.1.6, 2.10.8 or a later version, which fixes this vulnerability. For a full description of these releases, see the Crucible Release Notes.

Patches

Binary patches are not available for this advisory. You need to either install one of the patch releases or apply recommended temporary workarounds.