[%22Vendor] Stored XSS in administrative linker functionality through the href parameter - CVE-2018-20240 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Low
Fix Version/s: 4.7.0
Affects Version/s: 4.6.1
Component/s: Repositories
Labels:

Symptom Severity:
Severity 3 - Minor
Bug Fix Policy:
View Atlassian Server bug fix policy

The administrative linker functionality in Atlassian Fisheye before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.

causes

FE-7175 Add whitelist entry for non-HTTP linker advcrm

Not Being Considered

relates to

CRUC-8381 Stored XSS in administrative linker functionality through the href parameter - CVE-2018-20240

Closed

mentioned in: Page Failed to load

Assignee:: Unassigned

Reporter:: Erin Jensby

Affected customers:: 0 This affects my team

Watchers:: 1 Start watching this issue

Created:: 14/Feb/2019 9:15 PM

Updated:: 30/May/2019 3:56 PM

Resolved:: 14/Feb/2019 9:19 PM

Details

Description

Attachments

Issue Links

Forms

Activity

[FE-7163] Stored XSS in administrative linker functionality through the href parameter - CVE-2018-20240

People

Dates