CVE-2019-15008 — Cross-site Scripting in Atlassian Crucible

CWE-79 — Cross-site Scripting3 documents3 sources

Severity

6.1MEDIUMNVD

EPSS

0.4%

top 38.71%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Atlassian Crucible Atlassian Fisheye

Timeline

PublishedDec 11

Latest updateMay 24

Description

The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the reviewedBranch parameter.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶CVEListV5atlassian/fisheyeunspecified — 4.7.3

▶NVDatlassian/fisheye< 4.7.3

▶CVEListV5atlassian/crucibleunspecified — 4.7.3

▶NVDatlassian/crucible< 4.7.3

🔴Vulnerability Details

GHSA

GHSA-wr7m-82gg-jpg8: The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4↗2022-05-24

▶

CVEList

CVE-2019-15008: The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4↗2019-12-11

▶