CVE-2018-13398: Atlassian Crucible

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a Cross-site request forgery (CSRF) vulnerability.

Affected products

• Atlassian Crucible: before 4.5.4 (fixed in 4.5.4)
• Atlassian Fisheye: before 4.5.4 (fixed in 4.5.4)

Published 2018-09-18. Last modified 2026-06-17.