Description (CNA)
The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Atlassian / Fisheye and Crucible | affected prior to 4.4.3; affected prior to 4.5.0 |
CWE
No CWE identifiers supplied.
References
- https://jira.atlassian.com/browse/FE-7006
- https://jira.atlassian.com/browse/CRUC-8173
- http://www.securityfocus.com/bid/103079
ADP enrichment
No English description supplied.