Description

The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the orderby parameter.

Remediation

References

CVE-2017-16864

Related Vulnerabilities

Ruby on Rails Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-3227)

Mailman CVE-2006-2941 Vulnerability (CVE-2006-2941)

Internet Information Services Other Vulnerability (CVE-2002-0075)

Drupal Core 8.x Security Bypass (8.0.0 - 8.1.6)

WordPress Ultimate Member Plugin Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2023-31216)

Severity

Medium

Classification

CVE-2017-16864 CWE-707

Tags

Missing Update Known Vulnerabilities