CVE-2020-4023

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the committerFilter parameter.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Atlassian	Crucible	>= unspecified, < 4.8.2
Atlassian	Fisheye	>= unspecified, < 4.8.2

References

https://jira.atlassian.com/browse/CRUC-8482Vendor Advisory
https://jira.atlassian.com/browse/FE-7298Vendor Advisory
https://jira.atlassian.com/browse/CRUC-8482Vendor Advisory
https://jira.atlassian.com/browse/FE-7298Vendor Advisory

Timeline

Published: Jun 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-40245.4The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8 CVE-2020-40254.8The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data CVE-2020-40264.3The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from v CVE-2020-40274.7Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass v CVE-2020-40285.3Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in som CVE-2020-40294.3The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2 CVE-2020-40306.5In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer ov CVE-2020-40317.5In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-ord CVE-2020-40324.3In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order. All clients with +glyph-cache /re CVE-2020-40336.5In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth <CVE-2020-40355.9In WatermelonDB (NPM package "@nozbe/watermelondb") before versions 0.15.1 and 0.16.2, a maliciously crafted record ID can exploit a SQL Inj CVE-2020-40375.4In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated