Unscored CVE-2018-20827 EUVD-2018-13369GHSA-ccfj-r436-q2hv

The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site sc…

Published Aug 9, 2019 · Updated Sep 16, 2024 · Assigned by atlassian

Vendor: Atlassian Product: Jira Category: Web / CMS

Description

The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the country parameter.

Affected products

Vendor	Product	Affected	Fixed
Atlassian	Jira	unspecified – < 7.13.1	7.13.1

References

https://jira.atlassian.com/browse/JRASERVER-69237