[JRASERVER-70858] Stored XSS in Add Field module - CVE-2019-20900 - Create and track feature requests for Atlassian products.

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Low
Resolution: Fixed
Affects Version/s: 8.2.1
Fix Version/s: 8.7.0
Component/s: Administration - Fields
Labels:

Introduced in Version:
8.02
Symptom Severity:
Severity 3 - Minor
Bug Fix Policy:
View Atlassian Server bug fix policy

Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the Add Field module.

Affected versions:

version < 8.7.0

Fixed versions:

8.7.0

Attachments

Issue Links

relates to

JRASERVER-44458 Using JavaScript in description field should require explicit configuration

Closed

mentioned in: Page Loading...; Page Loading...

Activity

People

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Votes:: 0 Vote for this issue

Watchers:: 6 Start watching this issue

Dates

Created:: 02/Apr/2020 4:28 AM

Updated:: 08/Sep/2020 1:37 PM

Resolved:: 02/Apr/2020 4:30 AM