Description

This advisory details critical security vulnerabilities that we have found in JIRA and fixed in recent versions of JIRA. These vulnerabilities affect all versions of JIRA up to and including 5.0.6.

  • Issue 1: Privilege escalation vulnerability
  • Issue 2: XSS Vulnerabilities
  • Issue 3: XSRF Vulnerability
  • Issue 4: Open Redirect Vulnerabilities

Remediation

Customers who have downloaded and installed JIRA should upgrade their existing JIRA installations or apply the patches to fix these vulnerabilities.

References

JIRA Security Advisory 2012-08-28

Related Vulnerabilities

WordPress Plugin SyntaxHighlighter Evolved Cross-Site Scripting (3.1.5)

WordPress Plugin Related Posts for WordPress Cross-Site Scripting (1.8.1)

WordPress Plugin CM Pop-Up banners for WordPress Cross-Site Scripting (1.4.10)

WordPress Plugin Video.js-HTML5 Video Player for Wordpress Cross-Site Scripting (3.2.3)

WordPress Plugin DJ EmailPublish Cross-Site Scripting (1.7.2)

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

XSS CSRF Privilege Escalation Url Redirection