Uploaded image for project: 'FishEye'
  1. FishEye
  2. FE-6890

Reflected XSS in the repository changelog resource through the start date and end date filter parameters - CVE-2017-9510

XMLWordPrintable

      The repository changelog resource in Atlassian FishEye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the start date and end date parameters.

            [FE-6890] Reflected XSS in the repository changelog resource through the start date and end date filter parameters - CVE-2017-9510

            Owen made changes -
            Workflow Original: FE-CRUC Bug Workflow [ 2943699 ] New: JAC Bug Workflow v3 [ 2956478 ]
            Owen made changes -
            Workflow Original: FECRU Development Workflow - Triage - Restricted [ 2409596 ] New: FE-CRUC Bug Workflow [ 2943699 ]
            David Black made changes -
            Remote Link Original: This issue links to "Page (Extranet)" [ 314337 ]
            David Black made changes -
            Labels Original: advisory-released cvss-medium security xss New: CVE-2017-9510 advisory-released cvss-medium security xss
            David Black made changes -
            Summary Original: Reflected XSS in the repository commit changelog resource through a filter parameter. New: Reflected XSS in the repository changelog resource through the start date and end date filter parameters - CVE-2017-9510
            David Black made changes -
            Priority Original: Low [ 4 ] New: Medium [ 3 ]
            David Black made changes -
            Description Original: There is a reflected XSS in the repository commit changelog resource through a filter parameter. New: The repository changelog resource in Atlassian FishEye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the start date and end date parameters.

            David Black added a comment -

            CVSS v3 score: 5.4 => Medium severity

            Exploitability Metrics

            Attack Vector Network
            Attack Complexity Low
            Privileges Required Low
            User Interaction Required

            Scope Metric

            Scope Changed

            Impact Metrics

            Confidentiality Low
            Integrity Low
            Availability None

            https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

            David Black added a comment - CVSS v3 score: 5.4 => Medium severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction Required Scope Metric Scope Changed Impact Metrics Confidentiality Low Integrity Low Availability None https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
            David Black made changes -
            Description Original: There is a reflected XSS in the parameter of the commit filter. New: There is a reflected XSS in the repository commit changelog resource through a filter parameter.
            David Black made changes -
            Summary Original: Reflected XSS in the parameter of the commit filter New: Reflected XSS in the repository commit changelog resource through a filter parameter.

              Unassigned Unassigned
              pswiecicki Piotr Swiecicki
              Affected customers:
              0 This affects my team
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: