Detections
Analytics

Okta Jira Authenticator < 3.1.5 Cross-Site Scripting

medium Web App Scanning Plugin ID 113339

Language:

Synopsis

Okta Jira Authenticator < 3.1.5 Cross-Site Scripting

Description

Okta Jira Authenticator toolkit versions below 3.1.5 suffer from a reflected Cross-Site Scripting (XSS) vulnerability. By injecting a specific payload in the `os_username` GET parameter, a remote unauthenticated attacker can execute arbitrary JavaScript code in the browser context of the target vulnerable Jira instance users.

Solution

Upgrade Okta Jira Authenticator to version 3.1.5 or later.

See Also

https://help.okta.com/en-us/Content/Topics/Settings/Version_Histories/Ver_History_JIRA_Authenticator_Toolkit.htm

Plugin Details

Severity: Medium

ID: 113339

Type: remote

Published: 9/6/2022

Updated: 9/6/2022

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS Score Source: Tenable

Vulnerability Information

Exploit Ease: No known exploits are available

Reference Information