• Type: Bug
• Resolution: Fixed
• Priority: Medium
• Fix Version/s: 4.4.3, 4.5.0
• Affects Version/s: None
• Component/s: None
• Labels:

  • CVE-2017-18093
  • advisory
  • advisory-released
  • cvss-medium
  • security
  • xss

[CRUC-8175] XSS in various resources through the location setting of a configured repository - CVE-2017-18093

Owen made changes - 16/Oct/2018 8:15 AM

Workflow

Original: FE-CRUC Bug Workflow [ 2941601 ]

New: JAC Bug Workflow v3 [ 2955670 ]

Owen made changes - 16/Oct/2018 4:41 AM

Workflow

Original: FECRU Development Workflow - Triage - Restricted [ 2632865 ]

New: FE-CRUC Bug Workflow [ 2941601 ]

David Black made changes - 19/Feb/2018 3:02 AM

Description

Original: Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the location setting of a configured repository.

New: Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository.

David Black made changes - 19/Feb/2018 2:59 AM

Fix Version/s		New: 4.5.0 [ 72296 ]
Fix Version/s		New: 4.4.3 [ 73502 ]
Fix Version/s	Original: 4.5.0 [ 71891 ]
Fix Version/s	Original: 4.4.3 [ 73503 ]
Key	Original: FE-7009	New: CRUC-8175
Project	Original: FishEye [ 11830 ]	New: Crucible [ 11771 ]

David Black made changes - 19/Feb/2018 2:59 AM

Labels

Original: CVE-2017-18093 advisory advisory-to-release cvss-medium security xss

New: CVE-2017-18093 advisory advisory-released cvss-medium security xss

Collapse comment: David Black added a comment - 19/Feb/2018 2:58 AM, Edited by David Black - 19/Feb/2018 3:00 AM

David Black added a comment - 19/Feb/2018 2:58 AM - edited

This is an independent assessment and you should evaluate its applicability to your own IT environment.
CVSS v3 score: 4.8 => Medium severity

Exploitability Metrics

Attack Vector	Network
Attack Complexity	Low
Privileges Required	High
User Interaction	Required

Scope Metric

Scope	Changed

Impact Metrics

Confidentiality	Low
Integrity	Low
Availability	None

https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Expand comment: David Black added a comment - 19/Feb/2018 2:58 AM, Edited by David Black - 19/Feb/2018 3:00 AM

David Black added a comment - 19/Feb/2018 2:58 AM - edited This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 4.8 => Medium severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required High User Interaction Required Scope Metric Scope Changed Impact Metrics Confidentiality Low Integrity Low Availability None https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

David Black made changes - 19/Feb/2018 2:58 AM

Link

New: This issue relates to FE-7008 [ FE-7008 ]

David Black made changes - 19/Feb/2018 2:58 AM

Link

Original: This issue is cloned from FE-7008 [ FE-7008 ]

David Black made changes - 19/Feb/2018 2:57 AM

Resolution		New: Fixed [ 1 ]
Status	Original: Needs Triage [ 10030 ]	New: Closed [ 6 ]

David Black made changes - 19/Feb/2018 2:57 AM

Link

New: This issue is detailed by FECRU-7295 [ FECRU-7295 ]

Load more older events