Description

The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the country parameter.

Remediation

References

CVE-2018-20827

Related Vulnerabilities

WordPress 4.3.x Multiple Vulnerabilities (4.3 - 4.3.10)

Apache Tomcat Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-2071)

Drupal Core 9.2.x Directory Traversal (9.2.0 - 9.2.1)

Magento Cryptographic Issues Vulnerability (CVE-2019-7855)

Lighttpd Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2018-19052)

Severity

Medium

Classification

CVE-2018-20827 CWE-707

Tags

Missing Update Known Vulnerabilities