Security readout for executives and security teams
Plain-English summary
This CVE is a cross-site scripting issue in Atlassian Fisheye and Crucible. An attacker who can write to an indexed repository could create a malicious branch name that causes arbitrary HTML or JavaScript to run when deleted files from that branch are displayed.
Executive priority
Treat this as a moderate-priority remediation for affected developer tooling. The access prerequisite lowers mass-exploitation risk, but successful XSS inside source review systems can affect privileged users and sensitive development workflows.
Technical view
The vulnerable component is the source browse resource in Atlassian Fisheye and Crucible before 4.5.1 and 4.6.0. The issue is branch-name handling in a deleted-files display path, enabling XSS when attacker-controlled repository metadata is rendered by the application.
Likely exposure
Exposure is limited to organizations running affected Fisheye or Crucible versions with repositories indexed by the product and users who have write access to those repositories.
Exploitation context
The provided sources do not show known active exploitation or CISA KEV listing. Exploitation requires repository write access, so this is more likely an insider, compromised developer account, or supply-chain foothold scenario than broad unauthenticated scanning.
Researcher notes
Evidence is specific on component, affected product, versions, and trigger condition, but the bundle provides no CVSS vector, CWE, exploit telemetry, or detailed patch notes beyond the Atlassian issue references.
Mitigation direction
- Upgrade affected Fisheye and Crucible deployments to 4.5.1, 4.6.0, or later fixed releases.
- Review Atlassian issue pages for any version-specific guidance before remediation.
- Restrict repository write access to trusted users while remediation is pending.
- Prioritize instances exposed to large developer groups or less trusted contributors.
Validation and detection
- Inventory all Fisheye and Crucible instances and record exact versions.
- Confirm whether each instance indexes repositories where many users can create branches.
- Review repository branch names for unexpected HTML or script-like content.
- Check Atlassian FE-6994 and CRUC-8161 for fixed-version confirmation.
- Verify upgraded instances are no longer before 4.5.1 or 4.6.0.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-18034 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://jira.atlassian.com/browse/FE-6994CVE reference · x_refsource_CONFIRM
- https://jira.atlassian.com/browse/CRUC-8161CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.