CVE-2020-14166

The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.

Affected

Atlassian · Jira Service Desk Server and Data Center

CVSS v3.1 NVD

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

1.94% chance of exploitation in the next 30 days, 80th percentile

Published

2020-07-01

Updated

2024-09-16

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/49748

Security advisories

• https://jira.atlassian.com/browse/JSDSERVER-6895
• http://packetstormsecurity.com/files/162107/Atlassian-Jira-Service-Desk-4.9.1-Cross-Site-…

References

• CVE Record
• NVD entry