Rapid7 Vulnerability & Exploit Database

Atlassian JIRA: (CVE-2018-20239)

Free InsightVM Trial No Credit Card Necessary
Watch Demo See how it all works
Back to Search

Atlassian JIRA: (CVE-2018-20239)

Severity
4
CVSS
(AV:N/AC:M/Au:S/C:N/I:P/A:N)
Published
04/30/2019
Created
11/20/2019
Added
11/19/2019
Modified
11/19/2019

Description

Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2, Crucible before version 4.7.0, Crowd before version 3.4.3, Fisheye before version 4.7.0, Jira before version 7.13.3 and 8.x before 8.1.0.

Solution(s)

  • atlassian-jira-upgrade-7_13_3
  • atlassian-jira-upgrade-8_1_0

References

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;