CVE-2017-18093

EPSS 0.9%

Vexday Risk Score

3Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS —EPSS 0.9%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

19 Feb 2018Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository.

Affected products

Atlassian · Fisheye and Crucible

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://jira.atlassian.com/browse/CRUC-8175 https://jira.atlassian.com/browse/FE-7008 http://www.securityfocus.com/bid/103095