The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the rendering of retrieved content from a url location that could be manipulated by the up_projectid widget preference setting.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is version 7.6.x prior to 7.6.11 or 7.7.x prior to 7.13.1. It is, therefore, affected by a vulnerability which permits remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the rendering of retrieved content from a attacker controlled url location.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is prior to 7.6.11 or 7.7.x prior to 7.13.1. It is, therefore, affected by a cross-site scripting (XSS) vulnerability due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session.

ID	Name	Product	Family	Severity
113789	Atlassian Jira 7.7.0 < 7.13.1 Xss In The Labels Widget Gadget	Web App Scanning	Component Vulnerability	medium
113788	Atlassian Jira 7.6.0 < 7.6.11 Xss In The Labels Widget Gadget	Web App Scanning	Component Vulnerability	medium
124771	Atlassian JIRA Cross-Site Scripting (XSS) Vulnerability (JRASERVER-68614)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2018-20232

medium

Tenable Plugins

medium

medium

medium