Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2021-2024 and is owned by Tenable, Inc. or an Affiliate thereof.WEB_APPLICATION_SCANNING_112828
HistoryJul 02, 2021 - 12:00 a.m.

Atlassian Jira 8.6.x < 8.13.4 Multiple Vulnerabilities

2021-07-0200:00:00
This script is Copyright (C) 2021-2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
19
atlassian jira
vulnerabilities
cross-site scripting
dom
information disclosure
remote attackers
cve-2020-36288
cve-2021-26075
application data directory

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

44.9%

JSON

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.12, 8.6.x < 8.13.4 or 8.14.x < 8.15.1. It is, therefore, affected by multiple vulnerabilities:

  • A DOM based Cross-Site Scripting (XSS) vulnerability caused by parameter pollution. (CVE-2020-36288)

  • An information disclosure vulnerability in the error message when presented with an invalid filename allowing remote authenticated attackers to obtain the full path of the Jira application data directory. (CVE-2021-26075)

Note that the scanner has not tested for these issues but has instead relied only on the application’s self-reported version number.

No source data

Related

nessus 2
cnvd 2
atlassian 4
cve 2
cvelist 2
prion 2
nvd 2
nessus
nessus
Atlassian Jira < 8.5.12 Multiple Vulnerabilities
2021-07-02 00:00:00
Atlassian Jira 8.14.x < 8.15.1 Multiple Vulnerabilities (1/2)
2021-07-06 00:00:00
cnvd
cnvd
Atlassian Jira Server and Data Center has an unspecified vulnerability (CNVD-2021-55942)
2021-05-08 00:00:00
Atlassian Jira Server and Data Center Cross-Site Scripting Vulnerability (CNVD-2021-55943)
2021-05-08 00:00:00
atlassian
atlassian
Full path information disclose via invalid filename error message - CVE-2021-26075
2021-04-14 02:32:32
Full path information disclose via invalid filename error message - CVE-2021-26075
2021-04-14 02:32:32
DOM XSS in the issue navigation & search view via parameter pollution - CVE-2020-36288
2021-02-16 23:35:14
cve
cve
CVE-2021-26075
2021-04-15 00:15:12
CVE-2020-36288
2021-04-15 00:15:12
cvelist
cvelist
CVE-2021-26075
2021-04-14 23:45:18
CVE-2020-36288
2021-04-14 23:45:17
prion
prion
Information disclosure
2021-04-15 00:15:00
Cross site scripting
2021-04-15 00:15:00
nvd
nvd
CVE-2021-26075
2021-04-15 00:15:12
CVE-2020-36288
2021-04-15 00:15:12

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

44.9%

JSON
Related for WEB_APPLICATION_SCANNING_112828
nessus2cnvd2atlassian4cve2cvelist2prion2nvd2