CVE-2008-6831

Atlassian JIRA Enterprise Edition 3.13 - Cross-Site Scripting via Full Name or Return URL Parameter

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA Enterprise Edition 3.13 allow remote attackers to inject arbitrary web script or HTML via the (1) fullname (Full Name) parameter in the ViewProfile page or (2) returnUrl parameter in a form, as demonstrated using secure/AddComment!default.jspa (aka "Add Comment").

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/49415
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/31967
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/49416
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/46168
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32113
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/46167

Scores

EPSS 0.0049
EPSS Percentile 65.5%

Details

CWE
CWE-79
Status published
Products (1)
atlassian/jira 3.13
Published Jun 08, 2009
Tracked Since Feb 18, 2026