CVE-2018-20232

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the rendering of retrieved content from a url location that could be manipulated by the up_projectid widget preference setting.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Atlassian	Jira	>= unspecified, < 7.6.11; >= next of 7.7.0, < unspecified; >= unspecified, < 7.13.1

References

http://www.securityfocus.com/bid/107023Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/JRASERVER-68614Vendor Advisory
http://www.securityfocus.com/bid/107023Third Party Advisory, VDB Entry
https://jira.atlassian.com/browse/JRASERVER-68614Vendor Advisory

Timeline

Published: Feb 13, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-202336.5The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrato CVE-2018-202348.8There was an argument injection vulnerability in Atlassian Sourcetree for macOS from version 1.2 before version 3.1.1 via filenames in Mercu CVE-2018-202358.8There was an argument injection vulnerability in Atlassian Sourcetree for Windows from version 0.5a before version 3.0.15 via filenames in M CVE-2018-202368.8There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote at CVE-2018-202376.5Atlassian Confluence Server and Data Center before version 6.13.1 allows an authenticated user to download a deleted page via the word expor CVE-2018-202388.1Various rest resources in Atlassian Crowd before version 3.2.7 and from version 3.3.0 before version 3.3.4 allow remote attackers to authent CVE-2018-202395.4Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12 CVE-2018-20248.1IBM QRadar SIEM 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified CVE-2018-202404.8The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary H CVE-2018-202415.4The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTM CVE-2018-202426.1A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijack CVE-2018-202437.5The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fi