[CRUC-8169] XSS in the view review history resource through invited reviewers - CVE-2017-18089 - Create and track feature requests for Atlassian products.

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Medium
Resolution: Fixed
Affects Version/s: None
Fix Version/s: 4.4.3, 4.5.0
Component/s: None
Labels:

Symptom Severity:
Major
Bug Fix Policy:
View Atlassian Server bug fix policy

Description

The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the invited reviewers for a review.

Attachments

Activity

People

Assignee:

Unassigned

Reporter:

SecurityB

Participants:

David Black, SecurityB

Votes:

0 Vote for this issue

Watchers:

1 Start watching this issue

Dates

Due:

30/Mar/2018

Created:

02/Feb/2018 12:10 AM

Updated:

16/Feb/2018 3:40 AM

Resolved:

02/Feb/2018 3:16 AM

Last commented:

1 year, 20 weeks, 5 days ago