[JRASERVER-69238] XSS in WallboardServlet through the cyclePeriod parameter - CVE-2018-20824 - Create and track feature requests for Atlassian products.

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Medium
Resolution: Fixed
Affects Version/s: 7.7.0
Fix Version/s: 7.13.1, 8.0.0
Component/s: Dashboard & Gadgets
Labels:
- CVE-2018-20824
- advisory
- advisory-released
- bugbounty
- cvss-medium
- rxss
- security
- xss

Fixed in Long Term Support Release/s:

Download 7.13
Introduced in Version:
7.07
Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

Description

The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.

Attachments

Issue Links

mentioned in: Page Loading...

Activity

People

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Votes:: 0 Vote for this issue

Watchers:: 6 Start watching this issue

Dates

Created:: 29/Apr/2019 3:14 AM

Updated:: 14/Jul/2021 3:15 AM

Resolved:: 29/Apr/2019 3:22 AM