CVE-2017-9508

Description

Various resources in Atlassian Fisheye and Crucible before version 4.4.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a repository or review file.

Affected products

• Atlassian / Atlassian Fisheye and CrucibleAll versions prior to version 4.4.1 – All versions prior to version 4.4.1

References

• MISChttps://jira.atlassian.com/browse/CRUC-8044
• MISChttps://jira.atlassian.com/browse/FE-6898