VulnerabilityModified
CVE-2020-14166
The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS)…
MEDIUM 4.8EPSS 1.94%
Does this matter?
Lower severity and a low EPSS score (1.94%). Track it; it rarely justifies an emergency change on its own.
Description
The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.
- CVSS 3.1
- 4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.94% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- atlassian/jira service desk
- Source
- security@atlassian.com
References
- http://packetstormsecurity.com/files/162107/Atlassian-Jira-Service-Desk-4.9.1-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
- https://jira.atlassian.com/browse/JSDSERVER-6895Issue Tracking, Vendor Advisory
- http://packetstormsecurity.com/files/162107/Atlassian-Jira-Service-Desk-4.9.1-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
- https://jira.atlassian.com/browse/JSDSERVER-6895Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.