Uploaded image for project: 'Crucible'
  1. Crucible
  2. CRUC-8161

XSS in the source browser resource through malicious branch names - CVE-2017-18034

    XMLWordPrintable

Details

    Description

      The source browse resource in Atlassian FishEye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.

      Affected versions

      • Older than 4.5.1

      Fixed versions

      • 4.5.1 and higher
      • 4.6.0 and higher

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. FE-6994 XSS in the source browser resource through malicious branch names - CVE-2017-18034

          • Medium - Medium priority issues
          • Closed

          Activity

            People

              Unassigned Unassigned
              mparfianowicz Marek Parfianowicz
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: