CVE-2011-4822

Name of the Vulnerable Software and Affected Versions Atlassian FishEye versions prior to 2.5.5

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the user profile feature. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via two main vectors: snippets in a user comment, which is not properly handled in a Confluence page, and the user profile display name, which is not properly handled in a FishEye page.

Recommendations For versions prior to 2.5.5, update to version 2.5.5 or later to resolve the issue. As a temporary workaround, consider restricting user input for snippets in comments and user profile display names to minimize the risk of exploitation.