Detections
Analytics
Atlassian JIRA < 3.13.3 DWR 'c0-id' XSS
medium Nessus Plugin ID 36184
Language:
Synopsis
The remote web server hosts a web application that is affected by a cross-site scripting (XSS) vulnerability.Description
The Atlassian JIRA installation hosted on the remote web server is affected by a cross-site scripting (XSS) vulnerability due to a failure to sanitize input to the 'c0-id' parameter during a DWR call.A remote attacker, using a crafted URL, can exploit this to execute JavaScript in a user's browser.
Note that other issues have been reported with JIRA versions prior to 3.13.3; however, Nessus has not tested for these. Refer to the advisory for more information.
Solution
Upgrade to Atlassian JIRA 3.13.3 or later. Alternatively, apply the appropriate patches referenced in the vendor advisory.See Also
https://jira.atlassian.com/browse/CONF-11808
Plugin Details
Severity: Medium
ID: 36184
File Name: jira_3_13_3.nasl
Version: 1.21
Type: remote
Family: CGI abuses : XSS
Published: 4/17/2009
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.6
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:atlassian:jira
Required KB Items: installed_sw/Atlassian JIRA
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/2/2009
Vulnerability Publication Date: 4/2/2009
Reference Information
BID: 34342