Description

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the Add Field module. The affected versions are before version 8.7.0.

Remediation

References

CVE-2019-20900

Related Vulnerabilities

Rukovoditel Improper Input Validation Vulnerability (CVE-2020-11819)

OpenSSL Use of Insufficiently Random Values Vulnerability (CVE-2019-1549)

Drupal Core 4.7.x Cross-Site Scripting (4.7.0 - 4.7.4)

WordPress Plugin Product Lister for Walmart Remote Code Execution (1.0.1)

Atlassian Jira Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2021-41306)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2019-20900