The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jqlQuery query parameter.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is version 6.0.x prior to 7.2.12 or 7.4.4 prior to 7.6.1. It is, therefore, affected by a vulnerability which permits remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jqlQuery query parameter of the printable searchrequest issue resource.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by a cross-site scripting vulnerability in the jqlQuery query parameter of the printable searchrequest issue resource. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary code in a user's browser session.

ID	Name	Product	Family	Severity
113813	Atlassian Jira 7.4.4 < 7.6.1 Xss In Printable Searchrequest Issue Resource	Web App Scanning	Component Vulnerability	medium
113812	Atlassian Jira 6.0.0 < 7.2.12 Xss In Printable Searchrequest Issue Resource	Web App Scanning	Component Vulnerability	medium
122594	Atlassian JIRA < 7.2.12 / 7.3.x < 7.6.1 Cross-Site Scripting	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2017-14594

medium

Tenable Plugins

medium

medium

medium