CVEvulnerability
CVE-2007-6617
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-01-03
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in 500page.jsp in JIRA Enterprise Edition before 3.12.1 allows remote attackers to inject arbitrary web script or HTML, which is not properly handled when generating error messages, as demonstrated by input originally sent in the URI to secure/CreateIssue. NOTE: some of these details are obtained from third party information.
Affected configurations
• atlassian jira (<= 3.12)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2007-12-24 Patch
- http://jira.atlassian.com/browse/CONF-9560 jira.atlassian.com
- http://osvdb.org/42768 osvdb.org
- http://secunia.com/advisories/27954 Vendor Advisory
- http://www.securityfocus.com/bid/27094 www.securityfocus.com
- http://www.securityfocus.com/bid/27095 www.securityfocus.com
- http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2007-12-24 Patch
- http://jira.atlassian.com/browse/CONF-9560 jira.atlassian.com
- http://osvdb.org/42768 osvdb.org
- http://secunia.com/advisories/27954 Vendor Advisory
- http://www.securityfocus.com/bid/27094 www.securityfocus.com
- http://www.securityfocus.com/bid/27095 www.securityfocus.com