The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by pasting javascript code into the editor field.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.9 or 8.6.x prior to 8.8.2. It is, therefore, affected by a vulnerability which permits remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the WYSIWYG editor.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
113702	Atlassian Jira 8.6.x < 8.8.2 WYSIWYG Editor Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
113701	Atlassian Jira < 8.5.9 WYSIWYG Editor Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2020-14164

medium

Tenable Plugins

medium

medium