CVE-2020-4013

The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives.

Score

CVSS 3.1 5.4 Medium

Status

Modified - security@atlassian.com

Published

2020-06-01

Last modified

2024-09-16

Weaknesses

CWE-79

Affected products

• Crucible (Atlassian)
• Fisheye (Atlassian)

References

• https://jira.atlassian.com/browse/CRUC-8466
• https://jira.atlassian.com/browse/FE-7282