• Type: Bug
• Resolution: Fixed
• Priority: Low (View bug fix roadmap)
• Fix Version/s: 8.5.5, 8.8.2, 8.10.0, 8.9.1
• Affects Version/s: 8.7.1
• Component/s: Issue - Attachments
• Labels:

  • CVE-2020-4022
  • advisory
  • advisory-released
  • bugbounty
  • cvss-medium
  • security
  • sxss
  • xss

[JRASERVER-71107] XSS in Issue - Attachments - CVE-2020-4022

Collapse comment: Bl Ldd added a comment - 17/Jul/2020 5:28 PM, Edited by Bl Ldd - 17/Jul/2020 5:36 PM

Bl Ldd added a comment - 17/Jul/2020 5:28 PM - edited

Hi, any advisory on how to reproduce this?

Would definitely help!

Expand comment: Bl Ldd added a comment - 17/Jul/2020 5:28 PM, Edited by Bl Ldd - 17/Jul/2020 5:36 PM

Bl Ldd added a comment - 17/Jul/2020 5:28 PM - edited Hi, any advisory on how to reproduce this? Would definitely help!

Collapse comment: Security Metrics Bot added a comment - 28/May/2020 5:13 AM

Security Metrics Bot added a comment - 28/May/2020 5:13 AM

This is an independent assessment and you should evaluate its applicability to your own IT environment.
CVSS v3 score: 6.5 => Medium severity

Exploitability Metrics

Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	None

Scope Metric

Scope	Unchanged

Impact Metrics

Confidentiality	Low
Integrity	Low
Availability	None

https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Expand comment: Security Metrics Bot added a comment - 28/May/2020 5:13 AM

Security Metrics Bot added a comment - 28/May/2020 5:13 AM This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 6.5 => Medium severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required None User Interaction None Scope Metric Scope Unchanged Impact Metrics Confidentiality Low Integrity Low Availability None https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N