description: The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before 5.0.1, and from version 5.1.0 before 5.1.1 allows remote attackers to enumerate all linked applications, including those that are restricted or otherwise hidden, through an incorrect authorization check.
problem types: Incorrect Authorization
affected:
{
product: Navigator Links
vendor: Atlassian
versions:
lessThan: 3.2.23, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 4.0.0, versionType: custom
lessThan: 4.3.7, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 5.0.0, versionType: custom
lessThan: 5.0.1, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 5.1.0, versionType: custom
lessThan: 5.1.1, status: affected, version: unspecified, versionType: custom
}
{
product: Crucible
vendor: Atlassian
versions:
lessThan: 4.8.2, status: affected, version: unspecified, versionType: custom
}
{
product: Fisheye
vendor: Atlassian
versions:
lessThan: 4.8.2, status: affected, version: unspecified, versionType: custom
}
