VulnerabilityModified
CVE-2017-18090
Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a commit author.
MEDIUM 6.1EPSS 0.85%
Does this matter?
Lower severity and a low EPSS score (0.85%). Track it; it rarely justifies an emergency change on its own.
Description
Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a commit author.
- CVSS 3.0
- 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.85% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- atlassian/fisheye
- Source
- security@atlassian.com
References
- http://www.securityfocus.com/bid/103076Third Party Advisory, VDB Entry
- https://jira.atlassian.com/browse/FE-7000Vendor Advisory
- http://www.securityfocus.com/bid/103076Third Party Advisory, VDB Entry
- https://jira.atlassian.com/browse/FE-7000Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.