CVE-2020-14184

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in Jira issue filter export files. The affected versions are before 8.5.9, from version 8.6.0 before 8.12.3, and from version 8.13.0 before 8.13.1.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-141855.3Affected versions of Jira Server allow remote unauthenticated attackers to enumerate issue keys via a missing permissions check in the Actio CVE-2020-141889.8The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary c CVE-2020-141899.8The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code CVE-2020-14195.5An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka 'Windows Kernel In CVE-2020-141907.5Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. CVE-2020-141917.5Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS CVE-2020-141924.3Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerabili CVE-2020-141935.4Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside th CVE-2020-141945.4Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link.CVE-2020-141958.1FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity CVE-2020-141965.3In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not prop CVE-2020-141987.5Bitcoin Core 0.20.0 allows remote denial of service.