Description

The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3 and from version 7.10.0 before version 7.10.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the messagesThreshold parameter as the fix for CVE-2017-18039 was incomplete.

Remediation

References

CVE-2018-13387

Related Vulnerabilities

CubeCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2010-4903)

Seo Panel Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-28418)

Oracle JRE CVE-2013-2415 Vulnerability (CVE-2013-2415)

PHP Use After Free Vulnerability (CVE-2020-7068)

osTicket Other Vulnerability (CVE-2005-1438)

Severity

Medium

Classification

CVE-2018-13387 CWE-707

Tags

Missing Update Known Vulnerabilities