CVE-2020-4024 — Cross-site Scripting in Atlassian Jira Server AND Data Center

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
5.4MEDIUMNVD
EPSS
0.3%
top 49.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Atlassian Jira Server AND Data CenterAtlassian JiraAtlassian Jira Data Center+2 more
Timeline
PublishedJul 1
Latest updateMay 24

Description

The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a vnd.wap.xhtml+xml content type.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages5 packages

▶CVEListV5atlassian/jira_server_and_data_centerunspecified — 8.5.5+4
▶NVDatlassian/jira_data_center8.6.0 — 8.8.2+1
▶NVDatlassian/jira_server8.6.0 — 8.8.2+1
▶NVDatlassian/jira< 8.5.5

🔴Vulnerability Details

2
GHSA
GHSA-h8h7-522c-qwmm: The attachment download resource in Atlassian Jira Server and Data Center before 8↗2022-05-24
▶
CVEList
CVE-2020-4024: The attachment download resource in Atlassian Jira Server and Data Center before 8↗2020-07-01
▶