VULNERABILITY INTELLIGENCE

CVE-2021-43954

CVSS score4.3 MEDIUM

EPSS probability0.77%

CISA KEVNot currently listed

Published2022-03-14

Last modified2026-06-17

Description

The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.