CVE-2018-13392

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in linked issue keys.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Atlassian	Fisheye and Crucible	>= unspecified, < 4.6.0

References

http://www.securityfocus.com/bid/105096Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/CRUC-8304Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/FE-7081Issue Tracking, Third Party Advisory, Vendor Advisory
http://www.securityfocus.com/bid/105096Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/CRUC-8304Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/FE-7081Issue Tracking, Third Party Advisory, Vendor Advisory

Timeline

Published: Aug 13, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-133936.5The convertCommentToAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was CVE-2018-133946.5The acceptAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to CVE-2018-133956.1Various resources in Atlassian Jira before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, CVE-2018-133968.8There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 via Git subrepositories in Mer CVE-2018-133978.8There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 via Git subrepositories in CVE-2018-133986.5The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-com CVE-2018-133997.8The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges becaus CVE-2018-13407.5Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, wh CVE-2018-134004.7Several administrative resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before CVE-2018-134016.1The XsrfErrorAction resource in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before vers CVE-2018-134026.1Many resources in Atlassian Jira before version 7.6.9, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, fro CVE-2018-134035.4The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10, from version 7.7.0 before version 7.12.4, and from ver