PT-2009-2300 · Atlassian · Jira Enterprise Edition

Published 2009-06-08 · Updated 2017-08-17 · CVE-2008-6831

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Atlassian JIRA Enterprise Edition version 3.13

Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. This can be achieved via the fullname parameter in the ViewProfile page or the returnUrl parameter in a form. An example of exploitation is demonstrated using the "Add Comment" functionality, accessible through the secure/AddComment!default.jspa endpoint.

Recommendations: For Atlassian JIRA Enterprise Edition version 3.13, consider restricting access to the fullname and returnUrl parameters to minimize the risk of exploitation. As a temporary workaround, avoid using the fullname parameter in the ViewProfile page and the returnUrl parameter in forms until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-6831

Affected Products

Jira Enterprise Edition

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2008-6831 · Security Note
• http://secunia.com/advisories/32113 · Vendor Advisory
• http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2008-10-29 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46168 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46167 · Note
• http://osvdb.org/49415 · Note
• http://osvdb.org/49416 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6831 · Note
• http://securityfocus.com/bid/31967 · Note