[JRASERVER-72015] XSS via ViewWorkflowSchemes.jspa, ListWorkflows.jspa - CVE-2020-36236 - Create and track feature requests for Atlassian products.

Type: Public Security Vulnerability
Resolution: Fixed
Priority: Low (View bug fix roadmap)
Fix Version/s: 8.5.11, 8.13.3, 8.15.0
Affects Version/s: 8.5.0, 8.5.3, 8.13.0, 8.12.3
Component/s: None
Labels:

CVSS Score:
8.2
CVSS Severity:
High
CVE ID:
CVE-2020-36236

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the ViewWorkflowSchemes.jspa and ListWorkflows.jspa endpoints.

The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0.

Affected versions:

version < 8.5.11
8.6.0 ≤ version < 8.13.3
8.14.0 ≤ version < 8.15.0

Fixed versions:

8.5.11
8.13.3
8.15.0

mentioned in: Page Failed to load

Form Name

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Votes:: 0 Vote for this issue

Watchers:: 7 Start watching this issue

Created:: 21/Jan/2021 6:34 PM

Updated:: 16/Sep/2021 5:28 AM

Resolved:: 03/Feb/2021 11:05 PM

Details

Description

Attachments

Issue Links

Forms

Activity

[JRASERVER-72015] XSS via ViewWorkflowSchemes.jspa, ListWorkflows.jspa - CVE-2020-36236

People

Dates