Vulnerability in Atlassian Fisheye And Crucible

CVE-2018-20240

The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.

EPSS: 0.002 (39.0th percentile) — read the EPSS interpretation.

Affected products

Atlassian Fisheye And Crucible — versions unspecified

References

jira.atlassian.com/browse/FE-7163 (x_refsource_CONFIRM)
107128 (vdb-entry, x_refsource_BID)
jira.atlassian.com/browse/CRUC-8381 (x_refsource_CONFIRM)