CVE-2017-18034

{"id": "CVE-2017-18034", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2018-02-02T14:29:00.543", "references": [{"url": "https://jira.atlassian.com/browse/CRUC-8161", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@atlassian.com"}, {"url": "https://jira.atlassian.com/browse/FE-6994", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@atlassian.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch."}, {"lang": "es", "value": "El recurso de exploraci\u00f3n de fuentes en Atlassian Fisheye y Crucible en versiones anterores 4.5.1 y 4.6.0 permite a los atacantes remotos que tienen acceso de escritura a un repositorio indexado inyectar HTML o JavaScript arbitrario a trav\u00e9s de una vulnerabilidad de scripts de sitios cruzados (XSS) a trav\u00e9s de un nombre de rama del repositorio especialmente elaborado cuando se intenta mostrar los archivos eliminados de la rama"}], "lastModified": "2020-11-25T14:15:11.997", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC7AF5E6-136F-4DED-823F-602C6863265B", "versionEndExcluding": "4.5.1"}, {"criteria": "cpe:2.3:a:atlassian:crucible:4.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F48646D-1774-4036-8BBF-3BAA34EF4787"}, {"criteria": "cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "557AE134-DC5B-4546-8DF4-1E89BB32558E", "versionEndExcluding": "4.5.1"}, {"criteria": "cpe:2.3:a:atlassian:fisheye:4.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5342E75B-39DD-45F5-B794-CB63D7E8894A"}], "operator": "OR"}]}], "sourceIdentifier": "security@atlassian.com"}