CVE-2021-43954: Atlassian Crucible

Medium severity, CVSS 4.3. EPSS: 0.8% chance of exploitation in the next 30 days.

The DefaultRepositoryAdminService class in Fisheye and Crucible before version 4.8.9 allowed remote attackers, who have 'can add repository permission', to enumerate the existence of internal network and filesystem resources via a Server-Side Request Forgery (SSRF) vulnerability.

Affected products

• Atlassian Crucible: before 4.8.9 (fixed in 4.8.9)
• Atlassian Fisheye: before 4.8.9 (fixed in 4.8.9)

Published 2022-03-14. Last modified 2026-06-17.