CVE-2019-11584

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the priority icon url of an issue priority.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Atlassian	Jira	>= unspecified, < 8.3.2

References

https://jira.atlassian.com/browse/JRASERVER-69785Issue Tracking, Vendor Advisory
https://jira.atlassian.com/browse/JRASERVER-69785Issue Tracking, Vendor Advisory

Timeline

Published: Aug 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-115856.1The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 CVE-2019-115864.3The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before versio CVE-2019-115876.5Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version CVE-2019-115884.3The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version CVE-2019-115896.1The ChangeSharedFilterOwner resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before v CVE-2019-11597.8An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfu CVE-2019-115908.8The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local f CVE-2019-115918.8The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant l CVE-2019-115926.1WeBid 1.2.2 has reflected XSS via the id parameter to admin/deletenews.php, admin/editbannersuser.php, admin/editfaqscategory.php, or admin/CVE-2019-115938.1In Adblock Plus before 3.5.2, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when CVE-2019-115948.1In AdBlock before 3.45.0, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a we CVE-2019-115959.0In uBlock before 0.9.5.15, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a w