CVE-2020-4022

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
6.1MEDIUM
EPSS
0.3%
top 43.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Atlassian Jira Server AND Data CenterAtlassian JiraAtlassian Jira Data Center+2 more
Timeline
PublishedJul 1
Latest updateMay 24

Description

The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a mixed multipart content type.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages5 packages

▶CVEListV5atlassian/jira_server_and_data_centerunspecified — 8.5.5+4
▶NVDatlassian/jira_data_center8.6.0 — 8.8.2+1
▶NVDatlassian/jira_server8.6.0 — 8.8.2+1
▶NVDatlassian/jira< 8.5.5

🔴Vulnerability Details

2
GHSA
GHSA-49xr-3mhp-pp54: The attachment download resource in Atlassian Jira Server and Data Center before 8↗2022-05-24
▶
CVEList
CVE-2020-4022: The attachment download resource in Atlassian Jira Server and Data Center before 8↗2020-07-01
▶
CVE-2020-4022 (MEDIUM CVSS 6.1) | The attachment download resource in | cvebase.io