Description

The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a vnd.wap.xhtml+xml content type.

Remediation

References

CVE-2020-4024

Related Vulnerabilities

WordPress Other Vulnerability (CVE-2005-2107)

WordPress Plugin Copify Cross-Site Request Forgery (1.3.0)

WordPress Plugin Wp-D3 Cross-Site Request Forgery (2.4)

e107 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-36121)

XWiki Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2023-29524)

Severity

Medium

Classification

CVE-2020-4024 CWE-707

Tags

Missing Update Known Vulnerabilities