PT-2009-2300 · Atlassian · Jira Enterprise Edition

Publicado 2009-06-08 · Atualizado 2017-08-17 · CVE-2008-6831

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Atlassian JIRA Enterprise Edition version 3.13

Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. This can be achieved via the fullname parameter in the ViewProfile page or the returnUrl parameter in a form. An example of exploitation is demonstrated using the "Add Comment" functionality, accessible through the secure/AddComment!default.jspa endpoint.

Recommendations: For Atlassian JIRA Enterprise Edition version 3.13, consider restricting access to the fullname and returnUrl parameters to minimize the risk of exploitation. As a temporary workaround, avoid using the fullname parameter in the ViewProfile page and the returnUrl parameter in forms until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-6831

Produtos afetados

Jira Enterprise Edition

Referências · 9

• https://exchange.xforce.ibmcloud.com/vulnerabilities/46168 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46167 · Nota
• http://osvdb.org/49415 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-6831 · Nota de Segurança
• http://osvdb.org/49416 · Nota
• http://secunia.com/advisories/32113 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6831 · Nota
• http://securityfocus.com/bid/31967 · Nota
• http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2008-10-29 · Aviso do Fabricante