CVE-2017-18091

Опубликовано: 16 фев. 2018

Источник: nvd

CVSS3: 4.8

CVSS2: 3.5

EPSS Низкий

Описание

The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.

Ссылки

http://www.securityfocus.com/bid/103079
Third Party Advisory
VDB Entry
https://jira.atlassian.com/browse/CRUC-8173
Vendor Advisory
https://jira.atlassian.com/browse/FE-7006
Vendor Advisory
http://www.securityfocus.com/bid/103079
Third Party Advisory
VDB Entry
https://jira.atlassian.com/browse/CRUC-8173
Vendor Advisory
https://jira.atlassian.com/browse/FE-7006
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*

Версия от 4.4.0 (включая) до 4.4.3 (исключая)

Конфигурация 2

cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*

Версия от 4.4.0 (включая) до 4.4.3 (исключая)

EPSS

Процентиль: 39%

0.00177

Низкий

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-5ccm-pmf8-387g