Detections
Analytics
Atlassian JIRA 500page.jsp Referer XSS
medium Nessus Plugin ID 45578
Language:
Synopsis
The remote web server hosts a web application that is affected by a cross-site scripting (XSS) vulnerability.Description
The Atlassian JIRA installation hosted on the remote web server is affected by a cross-site scripting (XSS) vulnerability in the 500page.jsp file due to an HTTP 'referer' field not being properly sanitized before being displayed in the page. A remote attacker can exploit this, by tricking a user into making a specially crafted request, to execute arbitrary script code.This version of JIRA is also affected by additional vulnerabilities (cross-site scripting and privilege escalation); however, Nessus has not tested for these issues.
Solution
Apply the relevant patch referenced in the JIRA security advisory.See Also
Plugin Details
Severity: Medium
ID: 45578
File Name: jira_500page_referer_xss.nasl
Version: 1.18
Type: remote
Family: CGI abuses : XSS
Published: 4/20/2010
Updated: 6/5/2024
Configuration: Enable thorough checks
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Low
Score: 3.0
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:atlassian:jira
Required KB Items: installed_sw/Atlassian JIRA
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Exploited by Nessus: true
Patch Publication Date: 4/16/2010
Vulnerability Publication Date: 4/13/2010
Reference Information
CVE: CVE-2010-1164
BID: 39485