[FE-7035] XSS through header injection in the /browse/~raw resource - CVE-2018-5228 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Medium
Fix Version/s: 4.5.3, 4.6.0
Affects Version/s: 4.4.3, 4.5.1
Component/s: None
Labels:

Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.

is related to

CRUC-8201 XSS through header injection in the /browse/~raw resource - CVE-2018-5228

Closed

No work has yet been logged on this issue.

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Affected customers:: 0 This affects my team

Watchers:: 1 Start watching this issue

Created:: 22/Mar/2018 5:48 AM

Updated:: 23/Apr/2018 3:41 AM

Resolved:: 22/Mar/2018 5:49 AM

Details

Description

Attachments

Issue Links

Forms

Activity

[FE-7035] XSS through header injection in the /browse/~raw resource - CVE-2018-5228

People

Dates