VulnerabilityModified
CVE-2017-18091
The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site…
MEDIUM 4.8EPSS 0.84%
Does this matter?
Lower severity and a low EPSS score (0.84%). Track it; it rarely justifies an emergency change on its own.
Description
The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.
- CVSS 3.0
- 4.8 MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.84% probability · 56th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- atlassian/fisheye · atlassian/crucible
- Source
- security@atlassian.com
References
- http://www.securityfocus.com/bid/103079Third Party Advisory, VDB Entry
- https://jira.atlassian.com/browse/CRUC-8173Vendor Advisory
- https://jira.atlassian.com/browse/FE-7006Vendor Advisory
- http://www.securityfocus.com/bid/103079Third Party Advisory, VDB Entry
- https://jira.atlassian.com/browse/CRUC-8173Vendor Advisory
- https://jira.atlassian.com/browse/FE-7006Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.