CVE-2020-14166

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
AtlassianJira Service Desk Server and Data Center>= unspecified, < 4.10.0

References

Timeline

Published
Jul 1, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-141677.5The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2, aCVE-2020-141685.9The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 befCVE-2020-141696.1The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScrCVE-2020-14175.5An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfuCVE-2020-141704.3Webhooks in Atlassian Bitbucket Server from version 5.4.0 before version 7.3.1 allow remote attackers to access the content of internal netwCVE-2020-141716.5Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requesCVE-2020-141729.8This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemCVE-2020-141735.4The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JaCVE-2020-141744.3Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure DirectCVE-2020-141755.4Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-SCVE-2020-141776.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-basedCVE-2020-141787.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate project keys via an Information Disclosure vu
CVE-2020-14166: Medium severity, CVSS 4.8 | Vulnix