6.1med
CVE-2018-5230Nuclei template
The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
6.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
37.0%
percentile 99%
Public exploits
0
none known · Nuclei check
Summary
The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7.9.0 before version 7.9.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the error message of custom fields when an invalid value is specified.
Exploit prediction (EPSS)
37.03% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
Exploits and detections
- Nuclei template Atlassian Jira Confluence - Cross-Site Scripting · nuclei detection template
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected products
- Atlassian Jira
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- jira.atlassian.com /browse/JRASERVER-67289 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-5230
- NVD: CVE-2018-5230
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.