Remote Code Execution Risk in Atlassian Fisheye and Crucible for Web Applications
CVE-2020-4013

5.4MEDIUM

Key Information:

Vendor
Atlassian
Status
Crucible
Fisheye
Vendor
CVE Published:
1 June 2020

Summary

The review resource in Atlassian Fisheye and Crucible prior to version 4.8.1 is susceptible to a cross-site scripting (XSS) vulnerability. This flaw permits remote attackers to inject arbitrary HTML and JavaScript code through the review objectives interface. Exploiting this weakness could lead to unauthorized actions and access to sensitive information, compromising the security of affected web applications.

Affected Version(s)

Crucible < 4.8.1

Fisheye < 4.8.1

References

https://jira.atlassian.com/browse/FE-7282
x_refsource_MISC
https://jira.atlassian.com/browse/CRUC-8466
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.