CVE-2017-18091

Severity: medium (CVSS 4.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-02-16 · updated 2026-06-17
Weakness: CWE-79

Description

The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.

Affected products

Atlassian Crucible: from 4.4.0 before 4.4.3 — fixed in 4.4.3
Atlassian Fisheye: from 4.4.0 before 4.4.3 — fixed in 4.4.3

How to fix

Upgrade to a fixed version: Atlassian Crucible 4.4.3; Atlassian Fisheye 4.4.3. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/103079
https://jira.atlassian.com/browse/CRUC-8173
https://jira.atlassian.com/browse/FE-7006
http://www.securityfocus.com/bid/103079
https://jira.atlassian.com/browse/CRUC-8173
https://jira.atlassian.com/browse/FE-7006

Get alerted when CVE-2017-18091 or the next vulnerability affects your stack