Description

The labels gadget in Jira before version 7.13.2, and from version 8.0.0 before version 8.0.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jql parameter.

Remediation

References

CVE-2019-3400

Related Vulnerabilities

PostgreSQL Resource Management Errors Vulnerability (CVE-2007-4772)

MySQL CVE-2013-3798 Vulnerability (CVE-2013-3798)

WordPress Plugin Sports Rankings and Lists Cross-Site Scripting (3.5)

MediaWiki Improper Access Control Vulnerability (CVE-2015-8627)

WordPress 4.4.x Multiple Vulnerabilities (4.4 - 4.4.18)

Severity

Medium

Classification

CVE-2019-3400 CWE-707

Tags

Missing Update Known Vulnerabilities