Atlassian jira xss Vulnerability (CVE-2017-16864)

Atlassian jira xss Vulnerability (CVE-2017-16864)
Atlassian jira xss Vulnerability (CVE-2017-16864)

Release date:
Updated on:

Affected Systems:

Atlassian JIRA <7.4.2
Atlassian JIRA

Description:

Bugtraq id: 102505
CVE (CAN) ID: CVE-2017-16864

JIRA is a project and transaction tracking tool developed by Atlassian.

A cross-site scripting vulnerability exists in orderby parameter implementation in versions earlier than Atlassian Jira 7.4.2, allowing remote attackers to inject arbitrary HTML or JavaScript.

<* Source: vendor
*>

Suggestion:

Vendor patch:

Atlassian
---------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.atlassian.com/software/jira/
Https://jira.atlassian.com/browse/JRASERVER-66624