CVE-2017-14587
UnknownEPSS 0.85%
Last modified
CVE-2017-14587 is a vulnerability of currently unknown severity. The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.. EPSS estimates a 0.85% chance of exploitation in the next 30 days.
Description
The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Crucible | <= 4.4.1 |
| Atlassian | Fisheye | <= 4.4.1 |
References
- http://www.securityfocus.com/bid/101266Third Party Advisory, VDB Entry
- https://jira.atlassian.com/browse/CRUC-8112Vendor Advisory
- https://jira.atlassian.com/browse/FE-6933Vendor Advisory
- http://www.securityfocus.com/bid/101266Third Party Advisory, VDB Entry
- https://jira.atlassian.com/browse/CRUC-8112Vendor Advisory
- https://jira.atlassian.com/browse/FE-6933Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-14587?
The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.
How severe is CVE-2017-14587?
Severity scoring for CVE-2017-14587 is pending analysis. The EPSS model estimates a 0.85% probability of exploitation in the next 30 days.
How do I fix CVE-2017-14587?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-14580XnView Classic for Windows Version 2.41 allows attackers to …
- CVE-2017-14581The Host Control web service in SAP NetWeaver AS JAVA 7.0 th…7.5
- CVE-2017-14582The Zoho Site24x7 Mobile Network Poller application before 1…
- CVE-2017-14583NetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and…
- CVE-2017-14585A Server Side Request Forgery (SSRF) vulnerability could lea…
- CVE-2017-14586The Hipchat for Mac desktop client is vulnerable to client-s…9.8
- CVE-2017-14588Various resources in Atlassian Fisheye and Crucible before v…
- CVE-2017-14589It was possible for double OGNL evaluation in FreeMarker tem…
- CVE-2017-1459IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specif…
- CVE-2017-14590Bamboo did not check that the name of a branch in a Mercuria…
- CVE-2017-14591Atlassian Fisheye and Crucible versions less than 4.4.3 and …
- CVE-2017-14592Sourcetree for macOS had several argument and command inject…
Are you affected by CVE-2017-14587?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST