CVE-2017-14587

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

5.4MEDIUM

EPSS

0.2%

top 58.50%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Atlassian Crucible Atlassian Fisheye Atlassian Atlassian Fisheye AND Crucible

Timeline

PublishedOct 11

Latest updateMay 13

Description

The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5atlassian/atlassian_fisheye_and_crucibleAll versions prior to version 4.4.2

▶NVDatlassian/fisheye4.4.1

▶NVDatlassian/crucible4.4.1

🔴Vulnerability Details

GHSA

GHSA-w37q-9jx3-6cgj: The administration user deletion resource in Atlassian Fisheye and Crucible before version 4↗2022-05-13

▶

CVEList

CVE-2017-14587: The administration user deletion resource in Atlassian Fisheye and Crucible before version 4↗2017-10-11

▶