Atlassian Jira Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2010-1164 - Vulnerability Database

Atlassian Jira Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2010-1164

Medium

Reference: CVE-2010-1164

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2010-1164

Title: Atlassian Jira Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability

Overview:

Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3.12 through 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) element or (2) defaultColor parameter to the Colour Picker page the (3) formName parameter (4) element parameter or (5) full name field to the User Picker page the (6) formName parameter (7) element parameter or (8) group name field to the Group Picker page the (9) announcement_preview_banner_st parameter to unspecified components related to the Announcement Banner Preview page unspecified vectors involving the (10) groupnames.jsp (11) indexbrowser.jsp (12) classpath-debug.jsp (13) viewdocument.jsp or (14) cleancommentspam.jsp page the (15) portletKey parameter to runportleterror.jsp the (16) URI to issuelinksmall.jsp the (17) afterURL parameter to screenshot-redirecter.jsp or the (18) HTTP Referrer header to 500page.jsp as exploited in the wild in April 2010.