CVE-2020-9344

MEDIUMNuclei

Atlassian subversion_application_lifecycle_management Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2020-9344 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 19, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

subversion_application_lifecycle_management

Browse Atlassian / subversion_application_lifecycle_management
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMJira Subversion ALM for Enterprise <8.8.2 - Cross-Site ScriptingCVSS 6.1

Jira Subversion ALM for Enterprise before 8.8.2 contains a cross-site scripting vulnerability at multiple locations.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft or unauthorized actions.

Remediation

Upgrade Jira Subversion ALM for Enterprise to version 8.8.2 or later to mitigate this vulnerability.

WeaknessesCWE-79
Authorsmadrobot
Template tagscve2020cveatlassianjiraxssvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:atlassian:subversion_application_lifecycle_management:*:*:*:*:*:*:*:*
Shodan: http.component:"Atlassian Jira"
Shodan: http.component:"atlassian jira"
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9344 https://kintosoft.atlassian.net/wiki/spaces/SVNALM/pages/753565697/Security+Bulletin https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-007.txt https://nvd.nist.gov/vuln/detail/CVE-2020-13483 https://github.com/merlinepedra/nuclei-templates

Source: ProjectDiscovery

References

3