PT-2020-7188 · Atlassian · Jira+1

Published 2020-02-13 · Updated 2020-02-24 · CVE-2012-1500

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions JIRA version 4.4.3 GreenHopper versions prior to 5.9.8

Description The issue allows an attacker to inject arbitrary script code, enabling a Stored XSS attack. This is possible due to a vulnerability in the UpdateFieldJson.jspa file.

Recommendations For JIRA version 4.4.3, update to a version later than 4.4.3 to resolve the issue. For GreenHopper versions prior to 5.9.8, update to version 5.9.8 or later to fix the vulnerability. As a temporary workaround, consider restricting access to the UpdateFieldJson.jspa file until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-1500

Affected Products

Greenhopper

Jira

References · 5

• 🔥 https://exploit-db.com/exploits/21052 · Exploit
• 🔥 https://web.archive.org/web/20121014055829/http://cloudscan.me/2012/09/cve-2012-1500-ghs-5375-ghs-5642.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-1500 · Security Note
• https://t.me/cibsecurity/9830 · Telegram Post
• https://t.me/cvenotify/1010 · Telegram Post