Atlassian FishEye and Crucible 'dialog' Parameter Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	101268
Class:	Input Validation Error
CVE:	CVE-2017-14588
Remote:	Yes
Local:	No
Published:	Oct 11 2017 12:00AM
Updated:	Oct 11 2017 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Atlassian FishEye 2.7.12 0 Atlassian FishEye 2.6.8 0 Atlassian Fisheye 4.2 Atlassian Fisheye 4.0 Atlassian Fisheye 3.4.4 Atlassian Fisheye 3.4.3 Atlassian Fisheye 3.3.4 Atlassian Fisheye 3.3.3 Atlassian Fisheye 3.2.5 Atlassian Fisheye 3.2.4 Atlassian Fisheye 3.2 Atlassian Fisheye 3.1.7 Atlassian Fisheye 3.1.6 Atlassian Fisheye 3.0.4 Atlassian Fisheye 3.0.3 Atlassian Fisheye 3.0.2 Atlassian Fisheye 3.0.1 Atlassian Fisheye 2.7.10 Atlassian Fisheye 2.7.7 Atlassian Fisheye 2.7.6 Atlassian Fisheye 2.5.8 Atlassian Fisheye 2.5.6 Atlassian Fisheye 2.5.5 Atlassian Fisheye 2.4.6 Atlassian Fisheye 2.4.4 Atlassian Fisheye 2.4.3 Atlassian Fisheye 2.3.7 Atlassian Fisheye 2.3.6 Atlassian Fisheye 2.3.5 Atlassian Fisheye 2.3.4 Atlassian Fisheye 2.3.3 Atlassian Fisheye 2.3.2 Atlassian Fisheye 2.3.1 Atlassian Fisheye 2.3 Atlassian Fisheye 4.4.1 Atlassian Fisheye 3.2 Atlassian Fisheye 3.1 Atlassian Fisheye 2.7.9 Atlassian Fisheye 2.7.8 Atlassian Fisheye 2.7.5 Atlassian Fisheye 2.7.4 Atlassian Fisheye 2.7.3 Atlassian Fisheye 2.7.2 Atlassian Fisheye 2.7.15 Atlassian Fisheye 2.7.11 Atlassian Fisheye 2.7.1 Atlassian Fisheye 2.7.0 Atlassian Fisheye 2.7 Atlassian Fisheye 2.6.7 Atlassian Fisheye 2.6.6 Atlassian Fisheye 2.6.5 Atlassian Fisheye 2.6.4 Atlassian Fisheye 2.6.3 Atlassian Fisheye 2.6.2 Atlassian Fisheye 2.6.1 Atlassian Fisheye 2.6.0 Atlassian Fisheye 2.5.7 Atlassian Fisheye 2.5.4 Atlassian Fisheye 2.5.3 Atlassian Fisheye 2.5.2 Atlassian Fisheye 2.5.1 Atlassian Fisheye 2.5.0 Atlassian Fisheye 2.4.5 Atlassian Fisheye 2.4.2 Atlassian Fisheye 2.4.1 Atlassian Fisheye 2.4.0 Atlassian Fisheye 2.3.8 Atlassian Fisheye 2.2.8 Atlassian Fisheye 1.6.5.A Atlassian Fisheye 1.6.4 Atlassian Fisheye 1.6.3 Atlassian Fisheye 1.6.2 Atlassian Fisheye 1.6.1 Atlassian Fisheye 1.6.0 Atlassian Fisheye 1.5.4 Atlassian Fisheye 1.5.3 Atlassian Fisheye 1.5.2 Atlassian Fisheye 1.5.1 Atlassian Fisheye 1.5.0 Atlassian Fisheye 1.4.3 Atlassian Fisheye 1.4.2 Atlassian Fisheye 1.4.1 Atlassian Crucible 2.7.12 0 Atlassian Crucible 2.6.8 0 Atlassian Crucible 2.5.8 0 Atlassian Crucible 4.2 Atlassian Crucible 4.0 Atlassian Crucible 3.4.4 Atlassian Crucible 3.4.3 Atlassian Crucible 3.3.4 Atlassian Crucible 3.3.3 Atlassian Crucible 3.2.5 Atlassian Crucible 3.2.4 Atlassian Crucible 3.2 Atlassian Crucible 3.1.7 Atlassian Crucible 3.1.6 Atlassian Crucible 3.1.5 Atlassian Crucible 3.0.4 Atlassian Crucible 3.0.3 Atlassian Crucible 3.0.2 Atlassian Crucible 3.0.1 Atlassian Crucible 2.10.8 Atlassian Crucible 2.10.7 Atlassian Crucible 2.10.6 Atlassian Crucible 2.10.5 Atlassian Crucible 2.7.10 Atlassian Crucible 2.7.7 Atlassian Crucible 2.7.6 Atlassian Crucible 2.5.7 Atlassian Crucible 2.5.6 Atlassian Crucible 2.5.5 Atlassian Crucible 2.4.5 Atlassian Crucible 2.4.4 Atlassian Crucible 2.4.3 Atlassian Crucible 2.3.3 Atlassian Crucible 2.3.2 Atlassian Crucible 2.2.3 Atlassian Crucible 1.6.6 Atlassian Crucible 1.2.2 Atlassian Crucible 2.7.9 Atlassian Crucible 2.7.8 Atlassian Crucible 2.7.5 Atlassian Crucible 2.7.4 Atlassian Crucible 2.7.3 Atlassian Crucible 2.7.2 Atlassian Crucible 2.7.15 Atlassian Crucible 2.7.11 Atlassian Crucible 2.7.1 Atlassian Crucible 2.7.0 Atlassian Crucible 2.7 Atlassian Crucible 2.6.7 Atlassian Crucible 2.6.6 Atlassian Crucible 2.6.5 Atlassian Crucible 2.6.4 Atlassian Crucible 2.6.3 Atlassian Crucible 2.6.2 Atlassian Crucible 2.6.1 Atlassian Crucible 2.6.0 Atlassian Crucible 2.5.4 Atlassian Crucible 2.5.3 Atlassian Crucible 2.5.2 Atlassian Crucible 2.5.1 Atlassian Crucible 2.5.0 Atlassian Crucible 2.4.5 Atlassian Crucible 2.4.2 Atlassian Crucible 2.4.1 Atlassian Crucible 2.4.0 Atlassian Crucible 2.3.8 Atlassian Crucible 2.3.7 Atlassian Crucible 2.3.6 Atlassian Crucible 2.3.5 Atlassian Crucible 2.3.4 Atlassian Crucible 2.3.1 Atlassian Crucible 2.3.0 Atlassian Crucible 2.2.8 Atlassian Crucible 2.2.6 Atlassian Crucible 2.2.1 Atlassian Crucible 2.2.0 Atlassian Crucible 2.1.4 Atlassian Crucible 2.1.3 Atlassian Crucible 2.1.2 Atlassian Crucible 2.1.1 Atlassian Crucible 2.1.0 Atlassian Crucible 2.0.6 Atlassian Crucible 2.0.5 Atlassian Crucible 2.0.4 Atlassian Crucible 2.0.3 Atlassian Crucible 2.0.2 Atlassian Crucible 2.0.1 Atlassian Crucible 1.6.4 Atlassian Crucible 1.6.3 Atlassian Crucible 1.6.2 Atlassian Crucible 1.6.1 Atlassian Crucible 1.6.0 Atlassian Crucible 1.5.4 Atlassian Crucible 1.5.3 Atlassian Crucible 1.5.2 Atlassian Crucible 1.5.1 Atlassian Crucible 1.5.0 Atlassian Crucible 1.2.3 Atlassian Crucible 1.2.1 Atlassian Crucible 1.1.4 Atlassian Crucible 1.1.3 Atlassian Crucible 1.1.2 Atlassian Crucible 1.1.1
Not Vulnerable:	Atlassian Fisheye 4.5.0 Atlassian Fisheye 4.4.2 Atlassian Crucible 4.5.0 Atlassian Crucible 4.4.2

Atlassian FishEye and Crucible 'dialog' Parameter Multiple Cross Site Scripting Vulnerabilities

Atlassian FishEye and Crucible are prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Atlassian FishEye and Crucible 'dialog' Parameter Multiple Cross Site Scripting Vulnerabilities

To exploit these issues an attacker must entice an unsuspecting victim to open a malicious URI.

Atlassian FishEye and Crucible 'dialog' Parameter Multiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Atlassian FishEye and Crucible 'dialog' Parameter Multiple Cross Site Scripting Vulnerabilities

References:

• Atlassian Homepage (Atlassian)
  
• XSS in various resources through the dialog parameter - CVE-2017-14588 (Atlassian)
  
• XSS in various resources through the dialog parameter - CVE-2017-14588 (Atlassian)