CVE-2018-13387

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3 and from version 7.10.0 before version 7.10.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the messagesThreshold parameter as the fix for CVE-2017-18039 was incomplete.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Atlassian	Jira	>= unspecified, < 7.6.7; >= 7.7.0, < unspecified; >= unspecified, < 7.7.5; >= 7.8.0, < unspecified; >= unspecified, < 7.8.5; >= 7.9.0, < unspecified; >= unspecified, < 7.9.3; >= 7.10.0, < unspecified; >= unspecified, < 7.10.2

References

http://www.securityfocus.com/bid/104890Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/JRASERVER-67526Vendor Advisory
http://www.securityfocus.com/bid/104890Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/JRASERVER-67526Vendor Advisory

Timeline

Published: Jul 16, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-133885.4The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or Ja CVE-2018-133894.7The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Bro CVE-2018-13395.5A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.CVE-2018-133906.1Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subne CVE-2018-133915.3The ProfileLinkUserFormat component of Jira Server before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before CVE-2018-133926.1Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a CVE-2018-133936.5The convertCommentToAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was CVE-2018-133946.5The acceptAnswer resource in Atlassian Confluence Questions before version 2.6.6, the bundled version of Confluence Questions was updated to CVE-2018-133956.1Various resources in Atlassian Jira before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, CVE-2018-133968.8There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 via Git subrepositories in Mer CVE-2018-133978.8There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 via Git subrepositories in CVE-2018-133986.5The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-com