CVE-2007-6617

EPSS 0.45%
Veröffentlicht 03.01.2008 23:46:00
Zuletzt bearbeitet 09.04.2025 00:30:58
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

Cross-site scripting (XSS) vulnerability in 500page.jsp in JIRA Enterprise Edition before 3.12.1 allows remote attackers to inject arbitrary web script or HTML, which is not properly handled when generating error messages, as demonstrated by input originally sent in the URI to secure/CreateIssue.  NOTE: some of these details are obtained from third party information.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 9

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Atlassian ≫ Jira Editionenterprise Version <= 3.12

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.45%	0.606

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2007-12-24

Patch

http://jira.atlassian.com/browse/CONF-9560

http://osvdb.org/42768

http://secunia.com/advisories/27954

Vendor Advisory

http://www.securityfocus.com/bid/27094

http://www.securityfocus.com/bid/27095

https://nvd.nist.gov/vuln/detail/CVE-2007-6617

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2007-6617

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2007-6617

EUVD