Description

The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7.9.0 before version 7.9.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the error message of custom fields when an invalid value is specified.

Remediation

References

CVE-2018-5230

Related Vulnerabilities

XWiki Missing Authorization Vulnerability (CVE-2022-31167)

Oracle JRE CVE-2014-0449 Vulnerability (CVE-2014-0449)

WordPress Plugin Templatic Tevolution Arbitrary File Upload (2.3.6)

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions 'memberslist-csv.php' Information Disclosure (1.4.9)

IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-1240)

Severity

Medium

Classification

CVE-2018-5230 CWE-707

Tags

Missing Update Known Vulnerabilities