CVE-2017-18093: Atlassian Crucible

Medium severity, CVSS 4.8. EPSS: 0.8% chance of exploitation in the next 30 days.

Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository.

Affected products

• Atlassian Crucible: from 4.4.0, before 4.4.3 (fixed in 4.4.3)
• Atlassian Fisheye: from 4.4.0, before 4.4.3 (fixed in 4.4.3)

Published 2018-02-19. Last modified 2026-06-17.