[JRASERVER-73069] Stored XSS on /rest/jpo/1.0/hierarchyConfiguration via issueTypes parameter - CVE-2021-43945 - Create and track feature requests for Atlassian products.

Type: Public Security Vulnerability
Resolution: Fixed
Priority: Low (View bug fix roadmap)
Fix Version/s: 8.21.0, 8.20.3
Affects Version/s: 8.20.3
Component/s: None
Labels:

CVSS Score:
5.9
CVSS Severity:
Medium
CVE ID:
CVE-2021-43945

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or JavaScript via a Stored Cross-Site Scripting (SXSS) vulnerability in the /rest/jpo/1.0/hierarchyConfiguration endpoint.

The affected versions are before version 8.20.3.

Affected versions:

version < 8.20.3

Fixed versions:

8.20.3
8.21.0

mentioned in: Page Failed to load; Page Failed to load; Page Failed to load

Loading...

Type: Public Security Vulnerability
Resolution: Fixed
Priority: Low
Fix Version/s: 8.21.0, 8.20.3
Affects Version/s: 8.20.3
Component/s: None
Labels:

CVSS Score:
5.9
CVSS Severity:
Medium
CVE ID:
CVE-2021-43945

Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrary HTML or JavaScript via a Stored Cross-Site Scripting (SXSS) vulnerability in the /rest/jpo/1.0/hierarchyConfiguration endpoint.

The affected versions are before version 8.20.3.

Affected versions:

version < 8.20.3

Fixed versions:

8.20.3
8.21.0

mentioned in: Page Loading...; Page Loading...; Page Loading...

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Created:: 30/Nov/2021 6:48 PM

Updated:: 21/Feb/2023 3:40 PM

Resolved:: 28/Feb/2022 12:17 AM

Details

Description

Attachments

Issue Links

Forms

Activity