Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2017-18034

Опубликовано: 02 фев. 2018
Источник: nvd
CVSS3: 5.4
CVSS2: 3.5
EPSS Низкий

Описание

The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*
Версия до 4.5.1 (исключая)
cpe:2.3:a:atlassian:crucible:4.6.0:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*
Версия до 4.5.1 (исключая)
cpe:2.3:a:atlassian:fisheye:4.6.0:*:*:*:*:*:*:*

EPSS

Процентиль: 34%
0.0014
Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

github логотип

GHSA-x7hq-f29f-78q8

CVSS3: 5.4
github
больше 3 лет назад

The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.

EPSS

Процентиль: 34%
0.0014
Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79