• Type: Bug
• Resolution: Fixed
• Priority: Medium
• Fix Version/s: 2.5.5
• Affects Version/s: 2.5.4
• Component/s: None
• Labels:

  • advisory
  • cvss-high
  • security

[FE-3797] XSS vulnerability in user's profile display name

Owen made changes - 16/Oct/2018 8:16 AM

Workflow

Original: FE-CRUC Bug Workflow [ 2944370 ]

New: JAC Bug Workflow v3 [ 2958586 ]

Owen made changes - 16/Oct/2018 4:43 AM

Workflow

Original: FECRU Development Workflow - Triage - Restricted [ 1518279 ]

New: FE-CRUC Bug Workflow [ 2944370 ]

Owen made changes - 07/Jul/2016 6:38 AM

Workflow

Original: FECRU Development Workflow - Triage [ 940967 ]

New: FECRU Development Workflow - Triage - Restricted [ 1518279 ]

Security Metrics Bot made changes - 22/Sep/2015 8:57 AM

Labels

Original: advisory security

New: advisory cvss-high security

Piotr Swiecicki made changes - 17/Aug/2015 1:41 PM

Workflow

Original: FECRU Development Workflow (Triage) [ 351454 ]

New: FECRU Development Workflow - Triage [ 940967 ]

David Black made changes - 23/Dec/2013 3:50 AM

Resolution		New: Fixed [ 1 ]
Status	Original: Open [ 1 ]	New: Closed [ 6 ]

David Black made changes - 23/Dec/2013 3:49 AM

Description

Original: We have identified and fixed a stored cross-site scripting (XSS) vulnerability in the FishEye user profile. Affected versions are all versions earlier than 2.5.5 XSS vulnerabilities allow an attacker to embed their own JavaScript into a FishEye page. You can read more about XSS attacks at various places on the web, including these: * cgisecurity.com: http://www.cgisecurity.com/articles/xss-faq.shtml * The Web Application Security Consortium: http://projects.webappsec.org/Cross-Site+Scripting This issue is reported in our security advisory on this page: http://confluence.atlassian.com/x/dQH6Dw

New: We have identified and fixed a stored cross-site scripting (XSS) vulnerability in the FishEye user profile. Affected versions are all versions earlier than 2.5.5 XSS vulnerabilities allow an attacker to embed their own JavaScript into a FishEye page. You can read more about XSS attacks at various places on the web, including these: * cgisecurity.com: http://www.cgisecurity.com/articles/xss-faq.shtml * The Web Application Security Consortium: http://projects.webappsec.org/Cross-Site+Scripting This issue is reported in our security advisory on this page: https://confluence.atlassian.com/x/gAjSEQ

David Black made changes - 23/Dec/2013 3:49 AM

Resolution	Original: Fixed [ 1 ]
Status	Original: Closed [ 6 ]	New: Open [ 1 ]

VitalyA made changes - 01/Dec/2011 5:28 AM

Resolution		New: Fixed [ 1 ]
Status	Original: Needs Triage [ 10030 ]	New: Closed [ 6 ]

paulwatson (Inactive) made changes - 22/Nov/2011 6:04 AM

Security

Original: Reporters and Developers [ 10090 ]

Load more older history items