CVE-2019-15007 - The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch

Back Back to CVE browser

MEDIUM

The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch

Published Dec 11, 2019

4.8

MEDIUM

CVSS 3.1

EPSS 0.60%

Description

The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch.

Affected products

Vendor Atlassian Product Crucible Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <4.7.3
Vendor Atlassian Product Fisheye Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <4.7.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Atlassian

Crucible

n/a

Version	Status	Constraints
unspecified	affected	<4.7.3

Atlassian

Fisheye

n/a

Version	Status	Constraints
unspecified	affected	<4.7.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://jira.atlassian.com/browse/CRUC-8439
x_refsource_MISCIssue TrackingVendor Advisory
https://jira.atlassian.com/browse/FE-7250
x_refsource_MISCIssue TrackingVendor Advisory

Link	Providers	Tags
https://jira.atlassian.com/browse/CRUC-8439		x_refsource_MISCIssue TrackingVendor Advisory
https://jira.atlassian.com/browse/FE-7250		x_refsource_MISCIssue TrackingVendor Advisory