Vulnerability Database

289,784

Total vulnerabilities in the database

CVE-2017-18034

The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.

  • Published: Feb 2, 2018
  • Updated: Apr 13, 2023
  • CVE: CVE-2017-18034
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 5.4
  • AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

  • Severity: Low
  • Score: 3.5
  • AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
atlassian / crucible 4.6.0 4.6.0.x
atlassian / fisheye 4.6.0 4.6.0.x
atlassian / crucible - 4.5.1
atlassian / fisheye - 4.5.1