CVE-2017-18090

Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a commit author.

• CWE-79

• http://www.securityfocus.com/bid/103076Third Party Advisory, VDB Entry
• https://jira.atlassian.com/browse/FE-7000Vendor Advisory
• http://www.securityfocus.com/bid/103076Third Party Advisory, VDB Entry
• https://jira.atlassian.com/browse/FE-7000Vendor Advisory

Published

Feb 16, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-18084The usermacros resource in Atlassian Confluence Server befor…
• CVE-2017-18085The viewdefaultdecorator resource in Atlassian Confluence Se…
• CVE-2017-18086Various resources in Atlassian Confluence Server before vers…
• CVE-2017-18087The download commit resource in Atlassian Bitbucket Server f…
• CVE-2017-18088Various plugin servlet resources in Atlassian Bitbucket Serv…
• CVE-2017-18089The view review history resource in Atlassian Crucible befor…
• CVE-2017-18091The admin backupprogress action in Atlassian Fisheye and Cru…
• CVE-2017-18092The print snippet resource in Atlassian Crucible before vers…
• CVE-2017-18093Various resources in Atlassian Fisheye and Crucible before v…
• CVE-2017-18094Various resources in Atlassian Fisheye and Crucible before v…
• CVE-2017-18095The SnippetRPCServiceImpl class in Atlassian Crucible before…
• CVE-2017-18096The OAuth status rest resource in Atlassian Application Link…