• Type: Public Security Vulnerability
• Resolution: Fixed
• Priority: Low
• Fix Version/s: 4.21.0
• Affects Version/s: 4.20.0
• Component/s: None
• Labels:

  • advisory
  • advisory-to-release
  • dont-import
  • security

[JSDSERVER-10980] Stored XSS in "Object Schema" field of /secure/admin/InsightDefaultCustomFieldConfig.jspa - CVE-2021-43943

Security Metrics Bot made changes - 27/Feb/2022 8:28 PM

CVE ID

New: CVE-2021-43943

AB made changes - 24/Feb/2022 4:39 AM

Resolution		New: Fixed [ 1 ]
Security	Original: Atlassian Staff [ 10750 ]
Status	Original: Draft [ 12872 ]	New: Published [ 12873 ]

AB made changes - 24/Feb/2022 4:39 AM

Summary

Original: Stored XSS in "Object Schema" field of /secure/admin/InsightDefaultCustomFieldConfig.jspa - CVE registration for this issue is already in progress

New: Stored XSS in "Object Schema" field of /secure/admin/InsightDefaultCustomFieldConfig.jspa - CVE-2021-43943

AB made changes - 30/Dec/2021 4:51 AM

Summary

Original: Stored XSS in "Object Schema" field of /secure/admin/InsightDefaultCustomFieldConfig.jspa - Jira Service Management Server

New: Stored XSS in "Object Schema" field of /secure/admin/InsightDefaultCustomFieldConfig.jspa - CVE registration for this issue is already in progress

AB made changes - 30/Dec/2021 4:49 AM

Description

Original: Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in {component}. ((Use the `; versions` script here to list the fixed and affected versions))

New: Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the "Object Schema" field of /secure/admin/InsightDefaultCustomFieldConfig.jspa. The affected versions are before version 4.21.0. *Affected versions:*  * version < 4.21.0 *Fixed versions:*  * 4.21.0

AB made changes - 30/Dec/2021 4:49 AM

Description

Original: Affected versions of Atlassian Jira Service Management Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in {component}.

New: Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in {component}. ((Use the `; versions` script here to list the fixed and affected versions))

Security Metrics Bot made changes - 22/Dec/2021 3:05 AM

Labels

New: advisory advisory-to-release dont-import security

Security Metrics Bot created issue - 22/Dec/2021 3:05 AM