Lucene search

Security-metrics-botJRASERVER-73740

HistoryApr 20, 2022 - 8:14 p.m.

Reflected XSS on /secure/TeamManagement.jspa via "planUrl" parameter - CVE-2022-36801

2022-04-2020:14:02

security-metrics-bot

jira.atlassian.com

atlassian

jira

xss

teammanagement.jspa

cve-2022-36801

reflected cross-site scripting

vulnerability

html

javascript

remote attackers

version 8.20.8

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

42.6%

JSON

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (RXSS) vulnerability in the TeamManagement.jspa endpoint.

The affected versions are before version 8.20.8.

Affected versions:

version < 8.20.8

Fixed versions:

8.20.8

Affected configurations

Vulners

Node

atlassianjira_data_centerRange≤8.20.0

atlassianjira_data_centerRange<8.20.8

VendorProductVersionCPE
atlassianjira_data_center*cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
atlassian	jira_data_center	*	cpe:2.3:a:atlassian:jira_data_center::::::::

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

42.6%

JSON

Related for JRASERVER-73740