CVE-2020-36288 — Cross-site Scripting in Atlassian Jira Data Center

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
EPSS
0.7%
top 28.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Atlassian Jira Data CenterAtlassian Jira ServerAtlassian Data Center+1 more
Timeline
PublishedApr 15
Latest updateMay 24

Description

The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1 allows remote attackers to inject arbitrary HTML or JavaScript via a DOM Cross-Site Scripting (XSS) vulnerability caused by parameter pollution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages6 packages

▶CVEListV5atlassian/jira_data_centerunspecified — 8.5.12+4
▶NVDatlassian/jira_data_center8.6.0 — 8.13.4+1
▶CVEListV5atlassian/jira_serverunspecified — 8.5.12+4
▶NVDatlassian/data_center< 8.5.12
▶NVDatlassian/jira_server8.6.0 — 8.13.4+1

🔴Vulnerability Details

2
GHSA
GHSA-363q-pcwj-5wxw: The issue navigation and search view in Jira Server and Data Center before version 8↗2022-05-24
▶
CVEList
CVE-2020-36288: The issue navigation and search view in Jira Server and Data Center before version 8↗2021-04-14
▶
CVE-2020-36288 — Cross-site Scripting in Atlassian | cvebase