CVE-2017-18091

4.8 mediumEPSS 0.8%

The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.

Severity

CVSS 3.0

4.8 medium

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2018-02-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

atlassian:crucible
atlassian:fisheye

References

http://www.securityfocus.com/bid/103079
https://jira.atlassian.com/browse/CRUC-8173
https://jira.atlassian.com/browse/FE-7006
http://www.securityfocus.com/bid/103079
https://jira.atlassian.com/browse/CRUC-8173

Check your stack JSON