CVE-2018-5230

MEDIUMNuclei

Atlassian Jira Confluence - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2018-5230 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7.9.0 before version 7.9.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the error message of custom fields when an invalid value is specified.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Jira

Browse Atlassian / Jira
CVE ListBefore 7.6.6affected
7.7.0affected
Before 7.7.4affected
7.8.0affected
Before 7.8.4affected
7.9.0affected
Before 7.9.2affected

Nuclei templates

1
ProjectDiscoveryMEDIUMAtlassian Jira Confluence - Cross-Site ScriptingCVSS 6.1

Atlassian Jira Confluence before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4, and from version 7.9.0 before version 7.9.2, allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability in the error message of custom fields when an invalid value is specified.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the targeted user's browser, potentially leading to session hijacking, data theft, or other malicious activities.

Remediation

Apply the latest security patches or updates provided by Atlassian to mitigate this vulnerability.

WeaknessesCWE-79
Authorsmadrobot
Template tagscvecve2018atlassianconfluencexssvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
Shodan: http.component:"Atlassian Confluence"
Shodan: http.component:"atlassian jira"
Shodan: http.component:"atlassian confluence"
Shodan: cpe:"cpe:2.3:a:atlassian:jira"
https://jira.atlassian.com/browse/JRASERVER-67289 https://nvd.nist.gov/vuln/detail/CVE-2018-5230 https://github.com/sushantdhopat/JIRA_testing https://github.com/Elsfa7-110/kenzer-templates https://github.com/Faizee-Asad/JIRA-Vulnerabilities

Source: ProjectDiscovery

References

2