PT-2021-22381 · Atlassian · Jira

Published 2021-08-30 · Updated 2021-09-02 · CVE-2021-39117

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions prior to 8.18.0

Description The issue allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability. This is achieved by exploiting the name of a custom field in the AssociateFieldToScreens page.

Recommendations For versions prior to 8.18.0, update to version 8.18.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the AssociateFieldToScreens page until a patch is available. Avoid using custom field names that may be used to inject arbitrary HTML or JavaScript in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-39117

Affected Products

Jira

References · 7

• https://jira.atlassian.com/browse/JRASERVER-72597 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39117 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39117 · Security Note
• https://t.me/cibsecurity/27992 · Telegram Post
• https://t.me/cvenotify/20344 · Telegram Post
• https://t.me/cvenotify/20329 · Telegram Post
• https://t.me/cvenotify/20550 · Telegram Post