CVE-2020-4025

MEDIUM

Atlassian Jira < 8.5.5, 8.6.0-8.8.2 - Cross-Site Scripting via RDF Attachment Download

Title source: llm
STIX 2.1

Description

The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a rdf content type.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_misc
https://jira.atlassian.com/browse/JRASERVER-71114

Scores

CVSS v3 4.8
EPSS 0.0028
EPSS Percentile 51.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (4)
atlassian/jira < 8.5.5
atlassian/jira_data_center 8.6.0 - 8.8.2
atlassian/jira_server 8.6.0 - 8.8.2
atlassian/jira_software_data_center < 8.5.5
Published Jul 01, 2020
Tracked Since Feb 18, 2026