CVE-2020-14166

Опубликовано: 01 июл. 2020

Источник: nvd

CVSS3: 4.8

CVSS2: 3.5

EPSS Низкий

Описание

The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.

Ссылки

http://packetstormsecurity.com/files/162107/Atlassian-Jira-Service-Desk-4.9.1-Cross-Site-Scripting.html
Third Party Advisory
VDB Entry
https://jira.atlassian.com/browse/JSDSERVER-6895
Issue Tracking
Vendor Advisory
http://packetstormsecurity.com/files/162107/Atlassian-Jira-Service-Desk-4.9.1-Cross-Site-Scripting.html
Third Party Advisory
VDB Entry
https://jira.atlassian.com/browse/JSDSERVER-6895
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*

Версия до 4.10.0 (исключая)

cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:*

Версия до 4.10.0 (исключая)

EPSS

Процентиль: 73%

0.0076

Низкий

4.8 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-r66f-f7w5-7r65

github

больше 3 лет назад