• Type: Bug
• Resolution: Fixed
• Priority: Medium
• Fix Version/s: 6.2.0
• Affects Version/s: None
• Component/s: None
• Labels:

  • CVE-2017-18040
  • advisory
  • advisory-released
  • bamboo-bugfix-kanban
  • cvss-medium
  • security
  • xss

[BAM-19661] XSS in the viewDeploymentVersionCommits resource through the name of a release - CVE-2017-18040

Monique Khairuliana (Inactive) made changes - 19/Aug/2019 2:01 AM

Workflow	Original: Bamboo Workflow 2016 v1 - Restricted [ 2594768 ]	New: JAC Bug Workflow v3 [ 3382266 ]
Status	Original: Resolved [ 5 ]	New: Closed [ 6 ]

Owen made changes - 24/Oct/2018 5:06 AM

Symptom Severity

Original: Major [ 14431 ]

New: Severity 2 - Major [ 15831 ]

David Black made changes - 02/Feb/2018 3:45 AM

Description

Original: The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in a release name.

New: The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a release.

David Black made changes - 02/Feb/2018 3:45 AM

Summary

Original: XSS in the viewDeploymentVersionCommits resource - CVE-2017-18040

New: XSS in the viewDeploymentVersionCommits resource through the name of a release - CVE-2017-18040

David Black made changes - 02/Feb/2018 3:43 AM

Security

Original: Atlassian Staff [ 10750 ]

David Black made changes - 02/Feb/2018 3:43 AM

Labels

Original: advisory advisory-to-release bamboo-bugfix-kanban cvss-medium security xss

New: CVE-2017-18040 advisory advisory-released bamboo-bugfix-kanban cvss-medium security xss

David Black made changes - 02/Feb/2018 3:43 AM

Priority

Original: Low [ 4 ]

New: Medium [ 3 ]

David Black made changes - 02/Feb/2018 3:43 AM

Description

Original: Component in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in VULN_INFO.

New: The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in a release name.

David Black made changes - 02/Feb/2018 3:42 AM

Summary

Original: Sanitised security issue 55f649f744967ffac76bcee8a21c9aeacc30baa1a67f8703d976f0fb93ca9066

New: XSS in the viewDeploymentVersionCommits resource - CVE-2017-18040

David Black made changes - 02/Feb/2018 3:12 AM

Resolution		New: Fixed [ 1 ]
Status	Original: Needs Triage [ 10030 ]	New: Resolved [ 5 ]

Load more older history items