CVE-2020-4022

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a mixed multipart content type.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Atlassian	Jira Server and Data Center	>= unspecified, < 8.5.5; >= 8.6.0, < unspecified; >= unspecified, < 8.8.2; >= 8.9.0, < unspecified; >= unspecified, < 8.9.1

References

https://jira.atlassian.com/browse/JRASERVER-71107Vendor Advisory
https://jira.atlassian.com/browse/JRASERVER-71107Vendor Advisory

Timeline

Published: Jul 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-40235.4The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Java CVE-2020-40245.4The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8 CVE-2020-40254.8The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data CVE-2020-40264.3The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from v CVE-2020-40274.7Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass v CVE-2020-40285.3Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to the login page, in som CVE-2020-40294.3The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2 CVE-2020-40306.5In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer ov CVE-2020-40317.5In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-ord CVE-2020-40324.3In FreeRDP before version 2.1.2, there is an integer casting vulnerability in update_recv_secondary_order. All clients with +glyph-cache /re CVE-2020-40336.5In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth <CVE-2020-40355.9In WatermelonDB (NPM package "@nozbe/watermelondb") before versions 0.15.1 and 0.16.2, a maliciously crafted record ID can exploit a SQL Inj