CVE-2018-20241

Description

The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter.

References

https://jira.atlassian.com/browse/FE-7162

https://jira.atlassian.com/browse/CRUC-8380

http://www.securityfocus.com/bid/107128

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS