Vulnerability Description
The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a rdf content type.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Jira | < 8.5.5 |
| Atlassian | Jira Data Center | >= 8.6.0, < 8.8.2 |
| Atlassian | Jira Server | >= 8.6.0, < 8.8.2 |
| Atlassian | Jira Software Data Center | < 8.5.5 |
Related Weaknesses (CWE)
References
- https://jira.atlassian.com/browse/JRASERVER-71114Vendor Advisory
- https://jira.atlassian.com/browse/JRASERVER-71114Vendor Advisory
FAQ
What is CVE-2020-4025?
CVE-2020-4025 is a vulnerability with a CVSS score of 4.8 (MEDIUM). The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from ...
How severe is CVE-2020-4025?
CVE-2020-4025 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-4025?
Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Jira, Atlassian Jira Data Center, Atlassian Jira Server, Atlassian Jira Software Data Center.