CVE-2018-20240

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

4.8MEDIUM

EPSS

0.2%

top 60.75%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Atlassian Fisheye AND Crucible Atlassian Crucible Atlassian Fisheye

Timeline

PublishedFeb 20

Latest updateMay 14

Description

The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5atlassian/fisheye_and_crucibleunspecified — 4.7.0

▶NVDatlassian/fisheye< 4.7.0

▶NVDatlassian/crucible< 4.7.0

🔴Vulnerability Details

GHSA

GHSA-v9vm-w355-5p8c: The administrative linker functionality in Atlassian Fisheye and Crucible before version 4↗2022-05-14

▶

CVEList

CVE-2018-20240: The administrative linker functionality in Atlassian Fisheye and Crucible before version 4↗2019-02-20

▶