Lucene search

AtlassianCVE-2020-14166

HistoryJul 01, 2020 - 2:15 a.m.

CVE-2020-14166

2020-07-0102:15:11

CWE-79

atlassian

web.nvd.nist.gov

cve-2020-14166

jira

service desk

server

data center

xss

html

javascript

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

4.7

Confidence

High

EPSS

0.003

Percentile

65.7%

JSON

The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.

Affected configurations

Nvd

Node

atlassianjira_service_deskRange<4.10.0data_center

atlassianjira_service_deskRange<4.10.0server

VendorProductVersionCPE
atlassianjira_service_desk*cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*
atlassianjira_service_desk*cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:*

Vendor	Product	Version	CPE
atlassian	jira_service_desk	*	cpe:2.3:a:atlassian:jira_service_desk:::::data_center:::*
atlassian	jira_service_desk	*	cpe:2.3:a:atlassian:jira_service_desk:::::server:::*

CNA Affected

[
  {
    "product": "Jira Service Desk Server and Data Center",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "4.10.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

packetstormsecurity.com/files/162107/Atlassian-Jira-Service-Desk-4.9.1-Cross-Site-Scripting.html

jira.atlassian.com/browse/JSDSERVER-6895

Social References

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

4.7

Confidence

High

EPSS

0.003

Percentile

65.7%

JSON

Related for CVE-2020-14166