Various resources in Atlassian Jira before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3 and before version 7.11.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the epic colour field of an issue while an issue is being moved.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to version 7.6.10, 7.7.0 prior to 7.7.5, 7.8.0 prior to 7.8.5, 7.9.0 prior to7.9.3, 7.10.0 prior to 7.10.3, 7.11.0 prior to 7.11.3, 7.12.0 prior to 7.12.3 or 7.13.0 prior to 7.13.13. It is, therefore, affected by multiple vulnerabilities.

- A vulnerability which permits remote attackers who have administrator rights to determine the existence of internal hosts & open ports and in some cases obtain service information from internal network resources via a Server Side Request Forgery (SSRF) vulnerability (CVE-2018-13404).

- A vulnerability which permits remote attackers to obtain a user's Cross-site request forgery (CSRF) token through an open redirect vulnerability via the XsrfErrorAction resource (CVE-2018-13401).

- A vulnerability which permits remote attackers who have obtained access to administrator's session to access certain administrative resources without needing to re-authenticate via an improper access control (13400).

- A vulnerability which permits remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the epic colour field of an issue while an issue is being moved (13395).

- A vulnerability which permits remote attackers who can access & view an issue to obtain the email address of the reporter and assignee user of an issue despite the configured email visibility setting being set to hidden (CVE-2018-13391).

- A vulnerability which permits remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the messagesThreshold parameter due to an incomplete fix to CVE-2017-18039.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is potentially affected by a cross-site scripting vulnerability related to handling the 'the messagesThreshold' parameter in the IncomingMailServer resource.

ID	Name	Product	Family	Severity
113798	Atlassian Jira 7.13.x < 7.13.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
113797	Atlassian Jira 7.12.x < 7.12.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
113796	Atlassian Jira 7.11.x < 7.11.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
113795	Atlassian Jira 7.10.x < 7.10.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
113794	Atlassian Jira 7.9.x < 7.9.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
113793	Atlassian Jira 7.8.x < 7.8.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
113792	Atlassian Jira 7.7.x < 7.7.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
113791	Atlassian Jira 7.6.8 < 7.6.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
113790	Atlassian Jira < 7.6.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
111530	Atlassian JIRA 7.6.7 / 7.7.x < 7.7.5 / 7.8.x < 7.8.5 / 7.9.x < 7.9.3 / 7.10.x < 7.10.2 XSS	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2018-13395

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium