Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-70856

XSS via project configuration - CVE-2019-20416

XMLWordPrintable

      Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the project configuration feature.

      Affected versions:

      • version < 8.3.0

      Fixed versions:

      • 8.3.0

            [JRASERVER-70856] XSS via project configuration - CVE-2019-20416

            David Black made changes -
            Labels Original: CVE-2019-20416 advisory advisory-to-release bugbounty cvss-medium security xss New: CVE-2019-20416 advisory advisory-released bugbounty cvss-medium security xss
            AB made changes -
            Summary Original: XSS via project configuration New: XSS via project configuration - CVE-2019-20416
            AB made changes -
            Labels Original: advisory advisory-to-release bugbounty cve-in-progress cvss-medium security xss New: CVE-2019-20416 advisory advisory-to-release bugbounty cvss-medium security xss
            AB made changes -
            Labels Original: advisory advisory-to-release bugbounty cvss-medium security xss New: advisory advisory-to-release bugbounty cve-in-progress cvss-medium security xss
            Bugfix Automation Bot made changes -
            Introduced in Version New: 7.13
            AB made changes -
            Security Original: Atlassian Staff [ 10750 ]
            AB made changes -
            Resolution New: Fixed [ 1 ]
            Status Original: Needs Triage [ 10030 ] New: Closed [ 6 ]
            AB made changes -
            Summary Original: Sanitised security issue 54882d8c8734ecb0208d47bc81a0fb3446c690b9d66cf31eeea75ca5ca522093 New: XSS via project configuration
            AB made changes -
            Description Original: Component in Atlassian Jira Server and Data Center from version 7.13.3 before version 8.3.0 and from version 8.0.2 before version 8.3.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in VULN_INFO. New: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the project configuration feature.

            *Affected versions:*
             * version < 8.3.0

            *Fixed versions:*
             * 8.3.0
            Security Metrics Bot made changes -
            Link New: This issue is detailed by JRASERVER-69182 [ JRASERVER-69182 ]

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Affected customers:
              0 This affects my team
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: