CVE-2017-18091 — Cross-site Scripting in Atlassian Crucible

CWE-79 — Cross-site Scripting3 documents3 sources

Severity

4.8MEDIUMNVD

EPSS

0.2%

top 60.70%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Atlassian Crucible Atlassian Fisheye Atlassian Fisheye AND Crucible

Timeline

PublishedFeb 16

Latest updateMay 14

Description

The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5atlassian/fisheye_and_crucibleprior to 4.4.3, prior to 4.5.0+1

▶NVDatlassian/fisheye4.4.0 — 4.4.3

▶NVDatlassian/crucible4.4.0 — 4.4.3

🔴Vulnerability Details

GHSA

GHSA-5ccm-pmf8-387g: The admin backupprogress action in Atlassian Fisheye and Crucible before version 4↗2022-05-14

▶

CVEList

CVE-2017-18091: The admin backupprogress action in Atlassian Fisheye and Crucible before version 4↗2018-02-16

▶