[CRUC-8173] XSS in the admin backupprogress action through the filename of a backup - CVE-2017-18091 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Medium
Fix Version/s: 4.4.3, 4.5.0
Affects Version/s: None
Component/s: None
Labels:

Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.

relates to

FE-7006 XSS in the admin backupprogress action through the filename of a backup - CVE-2017-18091

Closed

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Affected customers:: 0 This affects my team

Watchers:: 1 Start watching this issue

Created:: 16/Feb/2018 4:25 AM

Updated:: 16/Feb/2018 4:31 AM

Resolved:: 16/Feb/2018 4:26 AM

Crucible

Details

Description

Attachments

Issue Links

Forms

Activity

[CRUC-8173] XSS in the admin backupprogress action through the filename of a backup - CVE-2017-18091

People

Dates