description: The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter.
problem types: Cross Site Scripting (XSS)
affected:
{
product: Fisheye and Crucible
vendor: Atlassian
versions:
lessThan: 4.7.0, status: affected, version: unspecified, versionType: custom
}