CVE:CVE-2018-13388
CNNVD:CNNVD-201807-966
Atlassian FishEye和Crucible都是澳大利亚Atlassian公司的产品。FishEye是一套源代码库深度查看软件。Crucible是一套代码审查工具。
Atlassian Fisheye和Crucible 4.5.3之前版本中的review attachment资源存在跨站脚本漏洞。远程攻击者可利用该漏洞注入任意的Web脚本或HTML。
solution:Upgrade atlassian crucible to a higher version than 4.5.3,and avoid the version (,4.5.3); Upgrade atlassian fisheye to a higher version than 4.5.3,and avoid the version (,4.5.3)