[FE-7162] XSS in edit upload for a review through the wbuser parameter - CVE-2018-20241 - Create and track feature requests for Atlassian products.

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Low
Resolution: Fixed
Affects Version/s: 4.6.1
Fix Version/s: 4.7.0
Component/s: None
Labels:

Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

Description

The Edit upload resource for a review in Atlassian Fisheye before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter.

Attachments

Issue Links

is related to

CRUC-8380 XSS in edit upload for a review through the wbuser parameter - CVE-2018-20241

Closed

Activity

People

Assignee:: Unassigned

Reporter:: Erin Jensby

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 14/Feb/2019 8:50 PM

Updated:: 30/May/2019 4:30 PM

Resolved:: 14/Feb/2019 8:50 PM