CVE-2020-4025 — Cross-site Scripting in Atlassian Jira Server AND Data Center

CWE-79 — Cross-site Scripting3 documents3 sources

Severity

4.8MEDIUMNVD

EPSS

0.3%

top 48.81%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Atlassian Jira Server AND Data Center Atlassian Jira Atlassian Jira Data Center +2 more

Timeline

PublishedJul 1

Latest updateMay 24

Description

The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a rdf content type.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages5 packages

▶CVEListV5atlassian/jira_server_and_data_centerunspecified — 8.5.5+4

▶NVDatlassian/jira_data_center8.6.0 — 8.8.2+1

▶NVDatlassian/jira_software_data_center< 8.5.5

▶NVDatlassian/jira_server8.6.0 — 8.8.2+1

▶NVDatlassian/jira< 8.5.5

🔴Vulnerability Details

GHSA

GHSA-88j6-4v89-hj98: The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center be↗2022-05-24

▶

CVEList

CVE-2020-4025: The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center be↗2020-07-01

▶