[JRASERVER-68855] XSS in the listApplicationLinks resource of the Application links plugin - CVE-2018-20239 - Create and track feature requests for Atlassian products.

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Medium
Resolution: Fixed
Affects Version/s: 7.13.0, 7.13.1, 8.0.0
Fix Version/s: 8.1.0, 7.13.3
Component/s: Application Links
Labels:

Fixed in Long Term Support Release/s:

Download 7.13
Introduced in Version:
7.13
Support reference count:
1
Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

Description

The version of the Application Links plugin used in Jira before version 7.13.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. See https://ecosystem.atlassian.net/browse/APL-1373 for more details.

Attachments

Issue Links

is related to

CWD-5362 XSS in the listApplicationLinks resource of the Application links plugin - CVE-2018-20239

Closed

APL-1373 Loading...

details: APL-1370 Loading...

relates to: BBSDEV-19392 Loading...; RAID-1119 Loading...; SECURITY-1179 Loading...

(1 relates to)

Activity

People

Assignee:: Ignat

Reporter:: David Black

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Due:: 11/Apr/2019

Created:: 14/Feb/2019 2:51 AM

Updated:: 22/May/2020 8:22 AM

Resolved:: 04/Apr/2019 11:56 AM