CVE-2020-4013

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Atlassian	Crucible	>= unspecified, < 4.8.1
Atlassian	Fisheye	>= unspecified, < 4.8.1

References

https://jira.atlassian.com/browse/CRUC-8466Vendor Advisory
https://jira.atlassian.com/browse/FE-7282Vendor Advisory
https://jira.atlassian.com/browse/CRUC-8466Vendor Advisory
https://jira.atlassian.com/browse/FE-7282Vendor Advisory

Timeline

Published: Jun 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-40144.3The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to remove another user's CVE-2020-40154.3The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user e CVE-2020-40165.3The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 allows r CVE-2020-40175.3The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before version 4.8.1 al CVE-2020-40188.8The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup process via a cross CVE-2020-40197.8The file editing functionality in the Atlassian Companion App before version 1.0.0 allows local attackers to have the app run a different ex CVE-2020-40207.2The file downloading functionality in the Atlassian Companion App before version 1.0.0 allows remote attackers, who control a Confluence Ser CVE-2020-40215.4Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject a CVE-2020-40226.1The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8 CVE-2020-40235.4The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Java CVE-2020-40245.4The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8 CVE-2020-40254.8The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data