CVE-2017-14587: XSS
The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14587?
CVE-2017-14587 has been classified as a medium severity vulnerability due to its potential impact on user data through cross site scripting.
How do I fix CVE-2017-14587?
To fix CVE-2017-14587, upgrade Atlassian FishEye or Crucible to version 4.4.2 or later.
Which versions are affected by CVE-2017-14587?
CVE-2017-14587 affects Atlassian FishEye and Crucible versions prior to 4.4.2.
What type of vulnerability is CVE-2017-14587?
CVE-2017-14587 is a cross site scripting (XSS) vulnerability that allows attackers to inject arbitrary HTML or JavaScript.
Who can exploit CVE-2017-14587?
Remote attackers can exploit CVE-2017-14587 to potentially compromise the administration user deletion resource.