CVE-2018-20824

MEDIUMNuclei

Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2018-20824 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Jira

Browse Atlassian / Jira
CVE ListBefore 7.13.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMAtlassian Jira WallboardServlet <7.13.1 - Cross-Site ScriptingCVSS 6.1

The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability in the cyclePeriod parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to Atlassian Jira version 7.13.1 or later to mitigate this vulnerability.

WeaknessesCWE-79
Authorsmadrobot, dwisiswant0
Template tagscve2018cveatlassianjiraxssvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
Shodan: http.component:"Atlassian Jira"
Shodan: http.component:"atlassian jira"
Shodan: http.component:"atlassian confluence"
Shodan: cpe:"cpe:2.3:a:atlassian:jira"
https://jira.atlassian.com/browse/JRASERVER-69238 https://nvd.nist.gov/vuln/detail/CVE-2018-20824 https://github.com/ARPSyndicate/kenzer-templates https://github.com/UGF0aWVudF9aZXJv/Atlassian-Jira-pentesting https://github.com/merlinepedra25/nuclei-templates

Source: ProjectDiscovery

References

2