Description

The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.

Remediation

References

CVE-2019-3402

Related Vulnerabilities

WordPress Plugin Count per Day Information Disclosure (3.2.5)

Zenphoto Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-0995)

Apache Tomcat Improper Locking Vulnerability (CVE-2019-10072)

WordPress Insecure Default Initialization of Resource Vulnerability (CVE-2017-5491)

WordPress Plugin Social Tape Cross-Site Request Forgery (1.0)

Severity

Medium

Classification

CVE-2019-3402 CWE-707

Tags

Missing Update Known Vulnerabilities