Vulnerability Description
The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a vnd.wap.xhtml+xml content type.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Jira | < 8.5.5 |
| Atlassian | Jira Data Center | >= 8.6.0, < 8.8.2 |
| Atlassian | Jira Server | >= 8.6.0, < 8.8.2 |
| Atlassian | Jira Software Data Center | < 8.5.5 |
Related Weaknesses (CWE)
References
- https://jira.atlassian.com/browse/JRASERVER-71113Vendor Advisory
- https://jira.atlassian.com/browse/JRASERVER-71113Vendor Advisory
FAQ
What is CVE-2020-4024?
CVE-2020-4024 is a vulnerability with a CVSS score of 5.4 (MEDIUM). The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or Jav...
How severe is CVE-2020-4024?
CVE-2020-4024 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-4024?
Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Jira, Atlassian Jira Data Center, Atlassian Jira Server, Atlassian Jira Software Data Center.