Description

The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1.

Remediation

References

CVE-2020-14173

Related Vulnerabilities

RubyGems Improper Input Validation Vulnerability (CVE-2015-4020)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-7866)

WordPress Plugin Forminator-Contact Form, Payment Form & Custom Form Builder SQL Injection (1.29.2)

WordPress Plugin Restaurant Menu by MotoPress Cross-Site Scripting (2.4.1)

WordPress Plugin Broken Link Checker Cross-Site Scripting (1.10.5)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2020-14173