Cross site scripting

2021-02-1500:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

45.0%

JSON

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the ViewWorkflowSchemes.jspa and ListWorkflows.jspa endpoints. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0.

CPENameOperatorVersion
jiralt8.5.11
jira_data_centerge8.6.0
jira_data_centerlt8.13.3
jira_serverge8.6.0
jira_serverlt8.13.3
jira_serverge8.14.0
jira_serverlt8.15.0
jira_software_data_centerlt8.5.11
jira_software_data_centerge8.14.0
jira_software_data_centerlt8.15.0

Name	Operator	Version
jira	lt	8.5.11
jira_data_center	ge	8.6.0
jira_data_center	lt	8.13.3
jira_server	ge	8.6.0
jira_server	lt	8.13.3
jira_server	ge	8.14.0
jira_server	lt	8.15.0
jira_software_data_center	lt	8.5.11
jira_software_data_center	ge	8.14.0
jira_software_data_center	lt	8.15.0

References

jira.atlassian.com/browse/JRASERVER-72015

0.001 Low

EPSS

Percentile

45.0%

JSON

Related for PRION:CVE-2020-36236