[CRUC-8112] XSS in the administration user deletion resource through the uname parameter - CVE-2017-14587 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Medium
Fix Version/s: 4.4.2, 4.5.0
Affects Version/s: None
Component/s: None
Labels:
- advisory
- advisory-released
- cvss-medium
- rxss
- security
- xss

Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

The administration user deletion resource in Atlassian FishEye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.

is cloned from

FE-6933 XSS in the administration user deletion resource through the uname parameter - CVE-2017-14587

Closed

No work has yet been logged on this issue.

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Affected customers:: 0 This affects my team

Watchers:: 2 Start watching this issue

Created:: 11/Oct/2017 1:19 AM

Updated:: 16/Oct/2017 12:40 AM

Resolved:: 11/Oct/2017 1:20 AM

Details

Description

Attachments

Issue Links

Forms

Activity

[CRUC-8112] XSS in the administration user deletion resource through the uname parameter - CVE-2017-14587

People

Dates