[FE-7162] XSS in edit upload for a review through the wbuser parameter - CVE-2018-20241 - Create and track feature requests for Atlassian products.

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Low
Resolution: Fixed
Affects Version/s: 4.6.1
Fix Version/s: 4.7.0
Component/s: None
Labels:

Symptom Severity:
Major
Bug Fix Policy:
View Atlassian Server bug fix policy

Description

The Edit upload resource for a review in Atlassian Fisheye before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter.

Attachments

Issue Links

is related to

CRUC-8380 XSS in edit upload for a review through the wbuser parameter - CVE-2018-20241

Closed

Activity

People

Assignee:

Unassigned

Reporter:

Erin Jensby

Participants:

Erin Jensby

Votes:

0 Vote for this issue

Watchers:

1 Start watching this issue

Dates

Created:

14/Feb/2019 8:50 PM

Updated:

30/May/2019 4:30 PM

Resolved:

14/Feb/2019 8:50 PM

Last commented:

26 weeks, 3 days ago