CVE-2016-6285

Опубликовано: 31 янв. 2017

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in includes/decorators/global-translations.jsp in Atlassian JIRA before 7.2.2 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.

Ссылки

http://packetstormsecurity.com/files/140548/Atlassian-Jira-7.1.7-Cross-Site-Scripting.html
Exploit
Third Party Advisory
http://seclists.org/fulldisclosure/2017/Jan/41
Exploit
Third Party Advisory
http://www.securityfocus.com/bid/95913
Third Party Advisory
VDB Entry
https://confluence.atlassian.com/adminjira/jira-platform-releases/jira-7-2-x-platform-release-notes#JIRA7.2.xplatformreleasenotes-7-2-2
Release Notes
https://jira.atlassian.com/browse/JRA-61888?src=confmacro&_ga=1.139403892.63283854.1485351777
Exploit
Vendor Advisory
http://packetstormsecurity.com/files/140548/Atlassian-Jira-7.1.7-Cross-Site-Scripting.html
Exploit
Third Party Advisory
http://seclists.org/fulldisclosure/2017/Jan/41
Exploit
Third Party Advisory
http://www.securityfocus.com/bid/95913
Third Party Advisory
VDB Entry
https://confluence.atlassian.com/adminjira/jira-platform-releases/jira-7-2-x-platform-release-notes#JIRA7.2.xplatformreleasenotes-7-2-2
Release Notes
https://jira.atlassian.com/browse/JRA-61888?src=confmacro&_ga=1.139403892.63283854.1485351777
Exploit
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*

Версия до 7.2.1 (включая)

EPSS

Процентиль: 72%

0.00767

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-73j8-52vp-m475