Description

The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the rendering of retrieved content from a url location that could be manipulated by the up_projectid widget preference setting.

Remediation

References

CVE-2018-20232

Related Vulnerabilities

WordPress Plugin BuddyPress 'page' Parameter SQL Injection (1.5.4)

WordPress Plugin Free counter Cross-Site Scripting (1.1)

Joomla! Core 1.6.0 Spam (1.6.0)

Zenphoto Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2015-5595)

WordPress Plugin More Fields Cross-Site Request Forgery (2.1)

Severity

Medium

Classification

CVE-2018-20232 CWE-707

Tags

Missing Update Known Vulnerabilities