CVE-2017-18094: XSS

Q: What is CVE-2017-18094?

CVE-2017-18094 is a vulnerability in Atlassian Fisheye and Crucible that allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.

Q: What is the severity of CVE-2017-18094?

The severity of CVE-2017-18094 is medium with a CVSS score of 4.8.

Q: Which versions of Atlassian FishEye are affected by CVE-2017-18094?

Atlassian FishEye versions 4.4.0 to 4.4.3 are affected by CVE-2017-18094.

Q: Which versions of Atlassian Crucible are affected by CVE-2017-18094?

Atlassian Crucible versions 4.4.0 to 4.4.3 are affected by CVE-2017-18094.

Q: How can I fix CVE-2017-18094?

To fix CVE-2017-18094, upgrade to Atlassian FishEye and Crucible version 4.4.3 (the fixed version for 4.4.x) or version 4.5.0.

Published Mar 22, 2018

Updated

Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository.

Affected Software

4 affected components

Atlassian FishEye>=4.4.0<4.4.3

Atlassian FishEye=4.5.0

Atlassian Crucible>=4.4.0<4.4.3

Atlassian Crucible=4.5.0

Event History

Mar 22, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2017-18094?

CVE-2017-18094 is a vulnerability in Atlassian Fisheye and Crucible that allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.

What is the severity of CVE-2017-18094?

The severity of CVE-2017-18094 is medium with a CVSS score of 4.8.

Which versions of Atlassian FishEye are affected by CVE-2017-18094?