Description

Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA Enterprise Edition 3.13 allow remote attackers to inject arbitrary web script or HTML via the (1) fullname (Full Name) parameter in the ViewProfile page or (2) returnUrl parameter in a form, as demonstrated using secure/AddComment!default.jspa (aka "Add Comment").

Remediation

References

CVE-2008-6831

Related Vulnerabilities

Oracle Database Server CVE-2015-2586 Vulnerability (CVE-2015-2586)

WebLogic CVE-2023-21931 Vulnerability (CVE-2023-21931)

MySQL CVE-2023-22038 Vulnerability (CVE-2023-22038)

Drupal Other Vulnerability (CVE-2024-22362)

MySQL CVE-2021-35631 Vulnerability (CVE-2021-35631)

Severity

Medium

Classification

CVE-2008-6831 CWE-707

Tags

Missing Update Known Vulnerabilities