• Type: Bug
• Resolution: Fixed
• Priority: Medium
• Fix Version/s: 6.3.1
• Affects Version/s: None
• Component/s: None
• Labels:

  • CVE-2017-18081
  • advisory
  • advisory-released
  • bamboo-bugfix-kanban
  • cvss-medium
  • security
  • xss

[BAM-19665] XSS in the signupUser resource through the value of the csrf token cookie - CVE-2017-18081

Monique Khairuliana (Inactive) made changes - 19/Aug/2019 2:04 AM

Workflow	Original: Bamboo Workflow 2016 v1 - Restricted [ 2594779 ]	New: JAC Bug Workflow v3 [ 3384801 ]
Status	Original: Resolved [ 5 ]	New: Closed [ 6 ]

Owen made changes - 24/Oct/2018 5:27 AM

Symptom Severity

Original: Minor [ 14432 ]

New: Severity 3 - Minor [ 15832 ]

David Black made changes - 02/Feb/2018 4:30 AM

Labels

Original: CVE-2017-18081 advisory advisory-to-release bamboo-bugfix-kanban cvss-medium security xss

New: CVE-2017-18081 advisory advisory-released bamboo-bugfix-kanban cvss-medium security xss

David Black made changes - 02/Feb/2018 4:29 AM

Labels

Original: advisory advisory-to-release bamboo-bugfix-kanban cvss-medium security xss

New: CVE-2017-18081 advisory advisory-to-release bamboo-bugfix-kanban cvss-medium security xss

David Black made changes - 02/Feb/2018 4:29 AM

Security

Original: Atlassian Staff [ 10750 ]

David Black made changes - 02/Feb/2018 4:26 AM

Summary

Original: XSS in the signupUser resource through the csrf token cookie value - CVE-2017-18081

New: XSS in the signupUser resource through the value of the csrf token cookie - CVE-2017-18081

David Black made changes - 02/Feb/2018 4:25 AM

Description

Original: The signup resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in VULN_INFO.

New: The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the value of the csrf token cookie.

David Black made changes - 02/Feb/2018 4:24 AM

Description

Original: Component in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in VULN_INFO.

New: The signup resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in VULN_INFO.

David Black made changes - 02/Feb/2018 4:23 AM

Summary

Original: XSS in the

New: XSS in the signupUser resource through the csrf token cookie value - CVE-2017-18081

David Black made changes - 02/Feb/2018 4:22 AM

Summary

Original: Sanitised security issue cdb3be82c553d499e5b595bb2d05e8636bf7c7eef3d49714aa143dc86573c0d7

New: XSS in the

Load more older history items