CVE-2020-4023: XSS
Published Jun 1, 2020
·Updated
The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the committerFilter parameter.
Affected Software
2 affected components
Atlassian Crucible<4.8.2
Atlassian FishEye<4.8.2
Event History
Jun 1, 2020
CVE Published
via MITRE·06:35 AM
Data Sourced
via MITRE·06:35 AM
DescriptionWeakness
Frequently Asked Questions
1
What is CVE-2020-4023?
CVE-2020-4023 is a cross-site scripting (XSS) vulnerability in Atlassian Fisheye and Crucible.
2
What is the severity of CVE-2020-4023?
The severity of CVE-2020-4023 is medium, with a CVSS score of 5.4.
3
How can remote attackers exploit CVE-2020-4023?
Remote attackers can exploit CVE-2020-4023 by injecting arbitrary HTML or Javascript through the committerFilter parameter in the review coverage resource.
4
Which versions of Atlassian Fisheye and Crucible are affected by CVE-2020-4023?
Atlassian Fisheye and Crucible versions up to and excluding 4.8.2 are affected by CVE-2020-4023.
5
Is there a fix available for CVE-2020-4023?
Yes, the fix for CVE-2020-4023 is included in version 4.8.2 of Atlassian Fisheye and Crucible.