CVE-2017-14588: Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject a...

Security readout for executives and security teams

Atlassian Fisheye and Crucible before 4.4.2 contain a cross-site scripting flaw in the dialog parameter. A remote attacker could inject arbitrary HTML or JavaScript into affected resources. The sources do not provide CVSS, exploit details, or active exploitation evidence. Organizations running Atlassian Fisheye or Crucible versions earlier than 4.4.2 are potentially exposed, especially where users access the service through a browser. The bundle does not identify specific deployment configurations or internet-facing risk. Treat as a targeted remediation item for legacy Atlassian developer tooling. Prioritize faster if the instance is internet-accessible, used by privileged developers, or integrated with sensitive source code workflows. Mitigation focus: Confirm whether Fisheye or Crucible is deployed and identify exact versions.; Upgrade affected instances to 4.4.2 or later, following Atlassian guidance.; Restrict access to source review tools while remediation is pending..

Prepared

Jun 12, 2026, 20:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.