Cross-site scripting (XSS) vulnerability in 500page.jsp in JIRA Enterprise Edition before 3.12.1 allows remote attackers to inject arbitrary web script or HTML, which is not properly handled when generating error messages, as demonstrated by input originally sent in the URI to secure/CreateIssue. NOTE: some of these details are obtained from third party information.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 3.12.1. It, therefore, has multiple vulnerabilities:

- a Cross-site scripting (XSS) vulnerability which allows remote attackers to inject arbitrary web script or HTML, which is not properly handled when generating error messages (CVE-2007-6617).

- A vulnerability which allows remote attackers to delete another user's shared filter via a modified filter ID (CVE-2007-6618).

- A flaw in the Setup Wizard does not properly restrict setup attempts after setup is complete, which allows remote attackers to change the default language (CVE-2007-6619).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Atlassian JIRA installation hosted on the remote web server is affected by a cross-site scripting (XSS) vulnerability due to a failure to properly sanitize user-supplied error messages before being passed to the 500page.jsp script. A remote attacker, using a crafted URL, can exploit this to execute arbitrary code in a user's browser.

Note that the application is also reportedly affected by multiple security bypass vulnerabilities; however, Nessus has not tested for these. Refer to the advisory for more information.

Atlassian JIRA, a web-based application for bug tracking, issue tracking and project management, installed on the remote web server is affected by one or more of the following issues :

 - A cross-site scripting issue due to its failure to sanitize error messages under a user's control and passed to the '500page.jsp' script before using them to generate dynamic output.

 - A security bypass issue that may allow an attacker to change JIRA's default language by accessing its first setup page directly.

 - A security bypass issue by which a user may delete a shared filter created by another user.


ID	Name	Product	Family	Severity
113823	Atlassian Jira < 3.12.1 Xss In 500 Page	Web App Scanning	Component Vulnerability	high
29834	Atlassian JIRA 500page.jsp XSS	Nessus	CGI abuses : XSS	medium
4329	Atlassian JIRA < 3.12.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2007-6617

medium

Tenable Plugins

high

medium

medium