• Type: Bug
• Resolution: Fixed
• Priority: Low (View bug fix roadmap)
• Fix Version/s: 8.5.5, 8.8.2, 8.10.0, 8.9.1
• Affects Version/s: 8.7.1
• Component/s: Issue - Attachments
• Labels:

  • CVE-2020-4024
  • advisory
  • advisory-released
  • bugbounty
  • cvss-high
  • security
  • xss

[JRASERVER-71113] XSS in Issue - Attachments - CVE-2020-4024

Mark Lang made changes - 13/Oct/2020 1:44 PM

Remote Link

New: This issue links to "Page (Confluence)" [ 508998 ]

Mark Lang made changes - 20/Aug/2020 3:30 AM

Remote Link

New: This issue links to "Page (Confluence)" [ 500450 ]

alexmin (Inactive) made changes - 01/Jul/2020 12:40 AM

Labels

Original: CVE-2020-4024 advisory advisory-to-release bugbounty cvss-high security xss

New: CVE-2020-4024 advisory advisory-released bugbounty cvss-high security xss

alexmin (Inactive) made changes - 01/Jul/2020 12:40 AM

Security

Original: Atlassian Staff [ 10750 ]

alexmin (Inactive) made changes - 03/Jun/2020 1:28 AM

Description

Original: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in issue attachments . *Affected versions:*  * version < 8.5.5  * 8.6.0 ≤ version < 8.8.2  * 8.9.0 ≤ version < 8.9.1 *Fixed versions:*  * 8.5.5  * 8.8.2  * 8.9.1  * 8.10.0

New: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a vnd.wap.xhtml+xml content type. *Affected versions:*  * version < 8.5.5  * 8.6.0 ≤ version < 8.8.2  * 8.9.0 ≤ version < 8.9.1 *Fixed versions:*  * 8.5.5  * 8.8.2  * 8.9.1  * 8.10.0

set-jac-bot made changes - 29/May/2020 11:08 AM

Fixed in Enterprise Release/s

New: [Download 8.5|https://confluence.atlassian.com/enterprise/atlassian-enterprise-releases-948227420.html]

Security Metrics Bot made changes - 29/May/2020 6:11 AM

Due Date

New: 27/Aug/2020

alexmin (Inactive) made changes - 29/May/2020 6:04 AM

Resolution		New: Fixed [ 1 ]
Status	Original: Needs Triage [ 10030 ]	New: Closed [ 6 ]

alexmin (Inactive) made changes - 29/May/2020 6:03 AM

Description

Original: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the issue attachments view. *Affected versions:*  * version < 8.5.5  * 8.6.0 ≤ version < 8.8.2  * 8.9.0 ≤ version < 8.9.1 *Fixed versions:*  * 8.5.5  * 8.8.2  * 8.9.1  * 8.10.0

New: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in issue attachments . *Affected versions:*  * version < 8.5.5  * 8.6.0 ≤ version < 8.8.2  * 8.9.0 ≤ version < 8.9.1 *Fixed versions:*  * 8.5.5  * 8.8.2  * 8.9.1  * 8.10.0

alexmin (Inactive) made changes - 29/May/2020 6:02 AM

Description

Original: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in Issue - Attachments. *Affected versions:*  * version < 8.5.5  * 8.6.0 ≤ version < 8.8.2  * 8.9.0 ≤ version < 8.9.1 *Fixed versions:*  * 8.5.5  * 8.8.2  * 8.9.1  * 8.10.0

New: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the issue attachments view. *Affected versions:*  * version < 8.5.5  * 8.6.0 ≤ version < 8.8.2  * 8.9.0 ≤ version < 8.9.1 *Fixed versions:*  * 8.5.5  * 8.8.2  * 8.9.1  * 8.10.0

Load more older events