CVE-2018-20240: The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remot...

Security readout for executives and security teams

This issue affects Atlassian Fisheye and Crucible before 4.7.0. A remote attacker could inject HTML or JavaScript through an administrative linker parameter, creating cross-site scripting risk for users who view the affected administrative functionality. Exposure is most likely in self-managed Fisheye or Crucible deployments running versions before 4.7.0. The source bundle does not identify cloud exposure, specific affected subversions, or required privileges beyond the administrative linker context. Address during normal vulnerability remediation unless the product is internet-exposed or heavily used by administrators. The business concern is browser-side compromise of trusted users, but public evidence does not support emergency treatment. Mitigation focus: Upgrade Fisheye and Crucible to version 4.7.0 or later where applicable.; Review Atlassian issue FE-7163 and CRUC-8381 for vendor-specific remediation guidance.; Restrict administrative interfaces to trusted users and networks where possible..

Prepared

Jun 6, 2026, 21:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.