[JRASERVER-69245] XSS in the labels gadget - CVE-2019-3400 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Medium (View bug fix roadmap)
Fix Version/s: 8.1.0, 7.13.2, 8.0.2
Affects Version/s: 7.8.2, 8.0.0
Component/s: Dashboard & Gadgets
Labels:
- CVE-2019-3400
- advisory
- advisory-released
- bugbash
- bugbounty
- cvss-medium
- security
- triaged
- xss

Fixed in Long Term Support Release/s:

Download 7.13
Introduced in Version:
7.08
Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jql parameter .

mentioned in: Page Failed to load

Form Name

Loading...

Type: Bug
Resolution: Fixed
Priority: Medium
Fix Version/s: 8.1.0, 7.13.2, 8.0.2
Affects Version/s: 7.8.2, 8.0.0
Component/s: Dashboard & Gadgets
Labels:
- CVE-2019-3400
- advisory
- advisory-released
- bugbash
- bugbounty
- cvss-medium
- security
- triaged
- xss

Fixed in Long Term Support Release/s:

Download 7.13
Introduced in Version:
7.08
Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jql parameter .

mentioned in: Page Loading...

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Votes:: 0 Vote for this issue

Watchers:: 8 Start watching this issue

Created:: 29/Apr/2019 4:09 AM

Updated:: 22/May/2020 8:24 AM

Resolved:: 29/Apr/2019 4:12 AM

Details

Description

Attachments

Issue Links

Forms

Activity