Vulnerability CVE-2020-14166

Vulnerability CVE-2020-14166

Published: 2020-07-01

Description:

The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.

See advisories in our WLB2 database:

	Topic	Author	Date
Low	Atlassian Jira Service Desk 4.9.1 Cross Site Scripting	Captain_hook	10.04.2021

Type:

CWE-79

(Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

CVSS2 => (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
3.5/10	2.9/10	6.8/10

Exploit range	Attack complexity	Authentication
Remote	Medium	Single time
Confidentiality impact	Integrity impact	Availability impact
None	Partial	None

Affected software
Atlassian -> Jira service desk

References:

https://jira.atlassian.com/browse/JSDSERVER-6895

Copyright 2024, cxsecurity.com