{"id": "ATLASSIAN:JRASERVER-72597", "vendorId": null, "type": "atlassian", "bulletinFamily": "software", "title": "Stored XSS via Custom Fields creation on AssociateFieldToScreens page - CVE-2021-39117", "description": "Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Stored Cross-Site Scripting (SXSS) vulnerability in\u00a0the Custom Fields creation feature on the AssociateFieldToScreens page.\r\n\r\nThis bug was introduced in version 8.15.0, and is fixed in version 8.18.0.\r\n\r\n**Affected versions:**\r\n * 8.15.0 \u2264 version < 8.18.0", "published": "2021-07-09T13:38:42", "modified": "2021-10-17T20:24:39", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7}, "href": "https://jira.atlassian.com/browse/JRASERVER-72597", "reporter": "security-metrics-bot", "references": [], "cvelist": ["CVE-2021-39117"], "immutableFields": [], "lastseen": "2021-11-26T18:44:30", "viewCount": 10, "enchantments": {"dependencies": {"references": [{"type": "atlassian", "idList": ["JRASERVER-72597"]}, {"type": "cve", "idList": ["CVE-2021-39117"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112953"]}], "rev": 4}, "score": {"value": 5.6, "vector": "NONE"}, "backreferences": {"references": [{"type": "atlassian", "idList": ["JRASERVER-72597"]}, {"type": "cve", "idList": ["CVE-2021-39117"]}, {"type": "nessus", "idList": ["WEB_APPLICATION_SCANNING_112953"]}]}, "exploitation": null, "vulnersScore": 5.6}, "affectedSoftware": [{"name": "jira server and data center", "operator": "le", "version": "8.15.0"}, {"name": "jira server and data center", "operator": "le", "version": "8.16.0"}, {"name": "jira server and data center", "operator": "le", "version": "8.17.0"}, {"name": "jira server and data center", "operator": "lt", "version": "8.18.0"}], "_state": {"dependencies": 1646122017}}

{"atlassian": [{"lastseen": "2022-01-05T06:13:46", "description": "Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Stored Cross-Site Scripting (SXSS) vulnerability in\u00a0the Custom Fields creation feature on the AssociateFieldToScreens page.\r\n\r\nThis bug was introduced in version 8.15.0, and is fixed in version 8.18.0.\r\n\r\n**Affected versions:**\r\n * 8.15.0 \u2264 version < 8.18.0", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "baseScore": 4.8, "privilegesRequired": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 2.7}, "published": "2021-07-09T13:38:42", "type": "atlassian", "title": "Stored XSS via Custom Fields creation on AssociateFieldToScreens page - CVE-2021-39117", "bulletinFamily": "software", "cvss2": {"severity": "LOW", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 3.5, "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-39117"], "modified": "2021-10-17T20:24:39", "id": "JRASERVER-72597", "href": "https://jira.atlassian.com/browse/JRASERVER-72597", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N"}}], "nessus": [{"lastseen": "2022-01-12T11:58:14", "description": "According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is 8.15.x prior to 8.18.0. It is, therefore, affected by a stored Cross-Site Scripting (XSS) vulnerability in the Custom Fields creation feature on the AssociateFieldToScreens page allowing remote attackers to inject arbitrary HTML or JavaScript.\n\nNote that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"score": 4.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"}, "published": "2021-09-10T00:00:00", "type": "nessus", "title": "Atlassian Jira 8.15.x < 8.18.0 Cross-Site Scripting", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2021-39117"], "modified": "2021-10-07T00:00:00", "cpe": ["cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*"], "id": "WEB_APPLICATION_SCANNING_112953", "href": "https://www.tenable.com/plugins/was/112953", "sourceData": "No source data", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N"}}], "cve": [{"lastseen": "2022-03-23T19:02:03", "description": "The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability via the name of a custom field.", "cvss3": {"exploitabilityScore": 1.7, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "baseScore": 4.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2021-08-30T07:15:00", "type": "cve", "title": "CVE-2021-39117", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 3.5, "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-39117"], "modified": "2021-09-02T02:41:00", "cpe": [], "id": "CVE-2021-39117", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-39117", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N"}, "cpe23": []}]}