• Type: Bug
• Resolution: Fixed
• Priority: Medium
• Fix Version/s: 4.5.3, 4.6.0
• Affects Version/s: 4.4.3, 4.5.1
• Component/s: None
• Labels:

  • CVE-2018-5228
  • advisory
  • advisory-released
  • cvss-medium
  • http-response-injection
  • injection
  • security
  • xss

[FE-7035] XSS through header injection in the /browse/~raw resource - CVE-2018-5228

Owen made changes - 16/Oct/2018 8:16 AM

Workflow

Original: FE-CRUC Bug Workflow [ 2942593 ]

New: JAC Bug Workflow v3 [ 2957680 ]

Owen made changes - 16/Oct/2018 4:42 AM

Workflow

Original: FECRU Development Workflow - Triage - Restricted [ 2660652 ]

New: FE-CRUC Bug Workflow [ 2942593 ]

David Black made changes - 23/Apr/2018 3:41 AM

Description

Original: The /browse/~raw resource in Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.

New: The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.

David Black made changes - 23/Apr/2018 3:39 AM

Description

Original: The /browse/~raw resource in Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the handling of response headers.

New: The /browse/~raw resource in Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.

David Black made changes - 23/Apr/2018 3:38 AM

Description

Original: The /browse/~raw resource in Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.

New: The /browse/~raw resource in Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the handling of response headers.

David Black made changes - 23/Apr/2018 3:37 AM

Summary

Original: XSS through header injection in the /browse/~raw resource -CVE-2018-5228

New: XSS through header injection in the /browse/~raw resource - CVE-2018-5228

David Black made changes - 23/Apr/2018 3:37 AM

Labels

Original: CVE-2018-5228 advisory advisory-to-release cvss-medium http-response-injection injection security xss

New: CVE-2018-5228 advisory advisory-released cvss-medium http-response-injection injection security xss

David Black made changes - 23/Apr/2018 3:37 AM

Link

New: This issue is related to FE-7036 [ FE-7036 ]

David Black made changes - 23/Apr/2018 3:37 AM

Link

Original: This issue was cloned as FE-7036 [ FE-7036 ]

David Black made changes - 23/Apr/2018 3:36 AM

Description

Original: The /browse/~raw resource in Fisheye and Crucible from version 4.4.3 before version 4.5.3 and from version 4.5.1 before version 4.6.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.

New: The /browse/~raw resource in Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.

Load more older history items