[CRUC-8381] Stored XSS in administrative linker functionality through the href parameter - CVE-2018-20240 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Low
Fix Version/s: 4.7.0
Affects Version/s: 4.6.1
Component/s: Server administration
Labels:

Symptom Severity:
Severity 3 - Minor
Bug Fix Policy:
View Atlassian Server bug fix policy

The administrative linker functionality in Atlassian Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.

is related to

FE-7163 Stored XSS in administrative linker functionality through the href parameter - CVE-2018-20240

Closed

Assignee:: Unassigned

Reporter:: Erin Jensby

Affected customers:: 0 This affects my team

Watchers:: 1 Start watching this issue

Created:: 14/Feb/2019 9:19 PM

Updated:: 20/Feb/2019 1:04 AM

Resolved:: 14/Feb/2019 9:20 PM

Crucible

Details

Description

Attachments

Issue Links

Forms

Activity

[CRUC-8381] Stored XSS in administrative linker functionality through the href parameter - CVE-2018-20240

People

Dates