Uploaded image for project: 'Jira Software Data Center'
  1. Jira Software Data Center
  2. JSWSERVER-20505

Security vulnerabilities exist in Javascript libraries used in Jira Software (8.8.0)

XMLWordPrintable

    • 3
    • We collect Jira feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see our Implementation of New Features Policy.

      Google Cloud Platform Cloud Web Security Scanner tags two javascript libraries as being outdated and potentially vulnerable:

      jquery 2.2.4

      More information at

       

      tinyMCE 4.6.4

      More information at

          Form Name

            [JSWSERVER-20505] Security vulnerabilities exist in Javascript libraries used in Jira Software (8.8.0)

            Chris Leiter added a comment -

            JQuery 2.2.4 has the following CVEs:

            – CVE-2015-9251
            – CVE-2015-9251
            – CVE-2019-11358
            – CVE-2020-11022
            – CVE-2020-11023 

            and Jira Server 8.20.2 still uses this version, which is a blocking point for us. Any plans to update JQuery?

            Thanks and regards,

             

            Chris Leiter added a comment - JQuery 2.2.4 has the following CVEs: – CVE-2015-9251 – CVE-2015-9251 – CVE-2019-11358 – CVE-2020-11022 – CVE-2020-11023  and Jira Server 8.20.2 still uses this version, which is a blocking point for us. Any plans to update JQuery? Thanks and regards,  

            Sergey added a comment -

            Tinymce is updated to version 5.8.0 as of JIRA 8.19+

            Sergey added a comment - Tinymce is updated to version 5.8.0 as of JIRA 8.19+

            Miryam Duella added a comment -

            A vulnerability assessment held on Jira Server 8.13.5 (in June 2021) has raised the following issue:

            The web application is using a JavaScript library that is known to contain at least one vulnerability (Vulnerable javascript library: TinyMCE version: 4.6.4).

            When are you planning to solve this security issue?

            Thanks, Best Regards

            Miryam Duella added a comment - A vulnerability assessment held on Jira Server 8.13.5 (in June 2021) has raised the following issue: The web application is using a JavaScript library that is known to contain at least one vulnerability (Vulnerable javascript library: TinyMCE version: 4.6.4). When are you planning to solve this security issue? Thanks, Best Regards

              Unassigned Unassigned
              1cce781a06eb Brian Dye
              Votes:
              18 Vote for this issue
              Watchers:
              21 Start watching this issue

                Created:
                Updated:
                Resolved: