CVE-2017-18094 Cross-site scripting in Fisheye and Crucible

What is CVE-2017-18094?

CVE-2017-18094 is a medium-severity cross-site scripting vulnerability in Atlassian Crucible, published on 22 Mar 2018. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository.

Weakness: CWE-79

Which versions are affected by CVE-2017-18094?

It affects 2 products.

Products include Atlassian Crucible, Atlassian Fisheye.

How do I fix CVE-2017-18094?

No fix has been published for CVE-2017-18094 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2017-18094 being exploited?

There is no known exploitation of CVE-2017-18094 in the wild and no public exploit code.

Other vulnerabilities in Atlassian Crucible

• CVE-2021-43958 Security feature bypass in Crucible Critical 9.8
• CVE-2017-16861 Code injection in Fisheye and Crucible Critical 9.8
• CVE-2017-14591 Command injection in Fisheye and Crucible Critical 9.0
• CVE-2020-4018 Cross-site request forgery in Crucible High 8.8
• CVE-2018-13399 Privilege escalation in Fisheye and Crucible High 7.8

All Atlassian Crucible vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v9g7-28gp-hc9w.