CVEvulnerability
CVE-2008-6831
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-06-08
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA Enterprise Edition 3.13 allow remote attackers to inject arbitrary web script or HTML via the (1) fullname (Full Name) parameter in the ViewProfile page or (2) returnUrl parameter in a form, as demonstrated using secure/AddComment!default.jspa (aka "Add Comment").
Affected configurations
• atlassian jira 3.13
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2008-10-29 Patch, Vendor Advisory
- http://osvdb.org/49415 osvdb.org
- http://osvdb.org/49416 osvdb.org
- http://secunia.com/advisories/32113 Vendor Advisory
- http://www.securityfocus.com/bid/31967 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46167 exchange.xforce.ibmcloud.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46168 exchange.xforce.ibmcloud.com
- http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2008-10-29 Patch, Vendor Advisory
- http://osvdb.org/49415 osvdb.org
- http://osvdb.org/49416 osvdb.org
- http://secunia.com/advisories/32113 Vendor Advisory
- http://www.securityfocus.com/bid/31967 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46167 exchange.xforce.ibmcloud.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46168 exchange.xforce.ibmcloud.com