XSS in the source browser resource through malicious branch names - CVE-2017-18034

XMLWordPrintable

    • Severity 2 - Major

      The source browse resource in Atlassian FishEye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.

      Affected versions

      • Older than 4.5.1

      Fixed versions

      • 4.5.1 and higher
      • 4.6.0 and higher

            Assignee:
            Unassigned
            Reporter:
            Marek Parfianowicz
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: