CVE-2019-8450

{"id": "CVE-2019-8450", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2019-09-11T14:15:12.337", "references": [{"url": "https://jira.atlassian.com/browse/JRASERVER-69795", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security@atlassian.com"}, {"url": "https://jira.atlassian.com/browse/JRASERVER-69795", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a custom field."}, {"lang": "es", "value": "Varias plantillas del plugin Optimization en Jira versiones anteriores a 7.13.6, y desde la versi\u00f3n 8.0.0 anteriores a 8.4.0, permiten a atacantes remotos, que tienen permiso para administrar campos personalizados, inyectar HTML o JavaScript arbitrario por medio de una vulnerabilidad de tipo cross-site-scripting (XSS) en el nombre de un campo personalizado."}], "lastModified": "2024-11-21T04:49:55.610", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2FED3DB9-E64F-4E15-B91A-03B408E4EA4C", "versionEndExcluding": "7.13.6", "versionStartIncluding": "7.13.0"}, {"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "080FC0DC-8A4F-4AC9-A326-0AA6165F58B6", "versionEndExcluding": "8.4.0", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@atlassian.com"}