CVE-2010-1164
published 2010-04-20CVE-2010-1164: Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3.12 through 4.1 allow remote attackers to inject arbitrary web script or HTML via the…
PriorityP274medium4.3CVSS 2.0
AVNACMAuNCNIPAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
2.23%
80.6th percentile
Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3.12 through 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) element or (2) defaultColor parameter to the Colour Picker page; the (3) formName parameter, (4) element parameter, or (5) full name field to the User Picker page; the (6) formName parameter, (7) element parameter, or (8) group name field to the Group Picker page; the (9) announcement_preview_banner_st parameter to unspecified components, related to the Announcement Banner Preview page; unspecified vectors involving the (10) groupnames.jsp, (11) indexbrowser.jsp, (12) classpath-debug.jsp, (13) viewdocument.jsp, or (14) cleancommentspam.jsp page; the (15) portletKey parameter to runportleterror.jsp; the (16) URI to issuelinksmall.jsp; the (17) afterURL parameter to screenshot-redirecter.jsp; or the (18) HTTP Referrer header to 500page.jsp, as exploited in the wild in April 2010.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | jira | — | — |
| atlassian | jira | — | — |
| atlassian | jira | — | — |
| atlassian | jira | — | — |
| atlassian | jira | — | — |
| atlassian | jira | — | — |
| atlassian | jira | — | — |
| atlassian | jira | — | — |
| atlassian | jira | — | — |
| atlassian | jira | — | — |
| atlassian | jira | — | — |
| atlassian | jira | — | — |
| atlassian | jira | — | — |
| atlassian | jira | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vulncheck4.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hq38-r2rw-x533: Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3
ghsa_unreviewed·2022-05-02
CVE-2010-1164 [MEDIUM] CWE-79 GHSA-hq38-r2rw-x533: Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3
Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3.12 through 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) element or (2) defaultColor parameter to the Colour Picker page; the (3) formName parameter, (4) element parameter, or (5) full name field to the User Picker page; the (6) formName parameter, (7) element parameter, or (8) group name field to the Group Picker page; the (9) announcement_preview_banner_st parameter to unspecified components, related to the Announcement Banner Preview page; unspecified vectors involving the (10) groupnames.jsp, (11) indexbrowser.jsp, (12) classpath-debug.jsp, (13) viewdocument.jsp, or (14) cleancommentspam.jsp page; the (15) portletKey parameter to runportleterror.jsp; the (16) URI to issuelinksmall.js
VulnCheck
Atlassian Jira Server and Data Center Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
vulncheck·2010·CVSS 4.3
CVE-2010-1164 [MEDIUM] Atlassian Jira Server and Data Center Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Atlassian Jira Server and Data Center Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3.12 through 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) element or (2) defaultColor parameter to the Colour Picker page; the (3) formName parameter, (4) element parameter, or (5) full name field to the User Picker page; the (6) formName parameter, (7) element parameter, or (8) group name field to the Group Picker page; the (9) announcement_preview_banner_st parameter to unspecified components, related to the Announcement Banner Preview page; unspecified vectors involving the (10) groupnames.jsp, (11) indexbrowser.jsp, (12) classpath-debug.jsp, (13) viewdocument.jsp
No detection rules found.
No public exploits indexed.
http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2010-04-16http://jira.atlassian.com/browse/JRA-20994http://jira.atlassian.com/browse/JRA-21004http://secunia.com/advisories/39353http://www.openwall.com/lists/oss-security/2010/04/16/3http://www.openwall.com/lists/oss-security/2010/04/16/4http://www.securityfocus.com/bid/39485https://exchange.xforce.ibmcloud.com/vulnerabilities/57826https://exchange.xforce.ibmcloud.com/vulnerabilities/57827http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2010-04-16http://jira.atlassian.com/browse/JRA-20994http://jira.atlassian.com/browse/JRA-21004http://secunia.com/advisories/39353http://www.openwall.com/lists/oss-security/2010/04/16/3http://www.openwall.com/lists/oss-security/2010/04/16/4http://www.securityfocus.com/bid/39485https://exchange.xforce.ibmcloud.com/vulnerabilities/57826https://exchange.xforce.ibmcloud.com/vulnerabilities/57827
2010-04-20
Published
Exploited in the wild