Skip to content
OpenAdvisories
Unscored CVE-2021-41304 EUVD-2021-28333GHSA-frf8-q8px-qghm

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cr…

Published Oct 26, 2021 · Updated Oct 10, 2024 · Assigned by atlassian

Vendor: Atlassian Product: Jira Data Center Product: Jira Server Category: Web / CMS

Description

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the /secure/admin/ImporterFinishedPage.jspa error message. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.2.

Affected products

VendorProductAffectedFixed
Atlassian Jira Server unspecified – < 8.13.12, 8.14.0 – < unspecified, unspecified – < 8.20.2 8.13.12
Atlassian Jira Data Center unspecified – < 8.13.12, 8.14.0 – < unspecified, unspecified – < 8.20.2 8.13.12

References