Cross-Site Scripting Vulnerability in Atlassian Crucible
CVE-2017-9509

5.4MEDIUM

Key Information:

Vendor
Atlassian
Status
Atlassian Crucible
Vendor
CVE Published:
24 August 2017

Summary

Atlassian Crucible prior to version 4.4.1 contains a Cross-Site Scripting vulnerability that allows remote attackers to inject malicious HTML or JavaScript code through the charset of previously uploaded files. This weakness can lead to unauthorized access or data manipulation, emphasizing the need for timely software updates to mitigate such threats.

Affected Version(s)

Atlassian Crucible All versions prior to version 4.4.1

References

https://jira.atlassian.com/browse/CRUC-8046
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.