[JRASERVER-69795] XSS in various templates of the Optimization plugin - CVE-2019-8450 - Create and track feature requests for Atlassian products.

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Low
Resolution: Fixed
Affects Version/s: 8.1.0, 7.13.3
Fix Version/s: 8.4.0, 7.13.6
Component/s: Custom Field Optimizer
Labels:

Fixed in Long Term Support Release/s:

Download 7.13
Introduced in Version:
7.13
Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

Description

Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a custom field.

Attachments

Issue Links

mentioned in: Page Loading...

Activity

People

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Votes:: 0 Vote for this issue

Watchers:: 0 Start watching this issue

Dates

Created:: 12/Aug/2019 2:47 AM

Updated:: 23/Jun/2020 8:22 AM

Resolved:: 12/Aug/2019 2:48 AM