Uploaded image for project: 'FishEye'
  1. FishEye
  2. FE-6994

XSS in the source browser resource through malicious branch names - CVE-2017-18034

XMLWordPrintable

      The source browse resource in Atlassian FishEye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.

      Affected versions

      • Older than 4.5.1

      Fixed versions

      • 4.5.1 and higher
      • 4.6.0 and higher

              Unassigned Unassigned
              mparfianowicz Marek Parfianowicz
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: