CVE-2017-14588: Atlassian Crucible

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the dialog parameter.

Affected products

• Atlassian Crucible: up to and including 4.4.1
• Atlassian Fisheye: up to and including 4.4.1

Published 2017-10-11. Last modified 2026-06-17.