CVE-2007-6617

Published Jan 3, 2008

Last updated 16 years ago

Overview

Description: Cross-site scripting (XSS) vulnerability in 500page.jsp in JIRA Enterprise Edition before 3.12.1 allows remote attackers to inject arbitrary web script or HTML, which is not properly handled when generating error messages, as demonstrated by input originally sent in the URI to secure/CreateIssue. NOTE: some of these details are obtained from third party information.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 4.3
Impact score: 2.9
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:N/I:P/A:N

Weaknesses

nvd@nist.gov: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:atlassian:jira:*:*:enterprise:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "204318E0-AA2F-4DCD-9CCE-73A2F2DD838D",
            "versionEndIncluding": "3.12"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References