CVE-2017-18089: XSS
The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the invited reviewers for a review.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Atlassian Crucible vulnerability?
The vulnerability ID for this Atlassian Crucible vulnerability is CVE-2017-18089.
What is the severity of CVE-2017-18089?
The severity of CVE-2017-18089 is medium with a severity value of 5.4.
How does the vulnerability in Atlassian Crucible before version 4.4.3 allow remote attackers to inject arbitrary HTML or JavaScript?
The vulnerability allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting (XSS) vulnerability through the invited reviewers for a review.
Which software versions are affected by CVE-2017-18089?
The software versions affected by CVE-2017-18089 are Atlassian Crucible versions 4.4.0 to 4.4.3 (inclusive) and version 4.5.0.
Is there a fix available for CVE-2017-18089?
Yes, the fix for CVE-2017-18089 is included in Atlassian Crucible version 4.4.3 (the fixed version for 4.4.x) and version 4.5.0.