CVE-2018-20241: The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote...

Security readout for executives and security teams

This issue affects Atlassian Fisheye and Crucible before 4.7.0. A remote attacker could inject HTML or JavaScript through the wbuser parameter in a review edit upload resource, creating a cross-site scripting risk for users who access affected pages. Exposure is likely limited to organizations running Atlassian Fisheye and Crucible before version 4.7.0, especially where the affected review upload resource is reachable by untrusted or lower-trust users. Treat this as a moderate web application risk. It can affect user trust and session safety, but the provided sources do not show active exploitation or severity scoring. Prioritize remediation for internet-facing or broadly accessible instances. Mitigation focus: Identify all Fisheye and Crucible instances and their installed versions.; Upgrade affected deployments to version 4.7.0 or later, per the affected-version boundary.; Review Atlassian issue guidance for any vendor-specific remediation details..

Prepared

Jun 6, 2026, 21:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.