XSS in the source browser resource through malicious branch names - CVE-2017-18034

XMLWordPrintable

    • Severity 2 - Major

      The source browse resource in Atlassian FishEye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.

      Affected versions

      • Older than 4.5.1

      Fixed versions

      • 4.5.1 and higher
      • 4.6.0 and higher

              Assignee:
              Unassigned
              Reporter:
              Marek Parfianowicz
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: