Security readout for executives and security teams
Plain-English summary
CVE-2020-14190 is a denial-of-service issue in Atlassian Fisheye and Crucible before 4.8.4. A remote attacker can use user-supplied regular expressions in EyeQL to consume excessive processing time, potentially slowing or disrupting source-code review services.
Executive priority
Treat this as a service-availability risk for code review and repository visibility platforms. Prioritize upgrade if Fisheye or Crucible is internet-facing, broadly accessible, or operationally important.
Technical view
Affected Fisheye/Crucible versions before 4.8.4 allow Regex Denial of Service through EyeQL regex handling. The source bundle does not provide CVSS, CWE, authentication requirements, or detailed vendor mitigation text beyond the fixed version boundary.
Likely exposure
Organizations running Atlassian Fisheye or Crucible versions earlier than 4.8.4 are potentially exposed, especially where EyeQL functionality is reachable by untrusted or broad user groups.
Exploitation context
The bundle does not show CISA KEV listing or cited evidence of active exploitation. The issue is remotely triggerable through user-supplied regex in EyeQL, but sources do not state exploit prevalence or authentication requirements.
Researcher notes
Evidence is limited to the CVE description and Atlassian issue references. No CVSS vector, CWE, affected version granularity, exploit status, or authentication context is provided in the bundle.
Mitigation direction
- Upgrade Fisheye and Crucible installations earlier than 4.8.4 to 4.8.4 or later.
- Review Atlassian CRUC-8498 and FE-7336 for vendor-specific guidance.
- Restrict EyeQL access to trusted users until affected instances are upgraded.
- Monitor Fisheye and Crucible resource usage for unusual CPU or request spikes.
Validation and detection
- Inventory all Fisheye and Crucible instances and record installed versions.
- Confirm no production instance runs a version earlier than 4.8.4.
- Review access controls around EyeQL-capable features.
- Check logs and monitoring for unexplained service slowdowns or regex-heavy query activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-14190 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://jira.atlassian.com/browse/CRUC-8498CVE reference · x_refsource_MISC
- https://jira.atlassian.com/browse/FE-7336CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.