CVE-2010-1164: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA 3.12 through 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) element or (2) defaultColor parameter to the Colour Picker page; the (3) formName parameter, (4) element parameter, or (5) full name field to the User Picker page; the (6) formName parameter, (7) element parameter, or (8) group name field to the Group Picker page; the (9) announcementpreviewbannerst parameter to unspecified components, related to the Announcement Banner Preview page; unspecified vectors involving the (10) groupnames.jsp, (11) indexbrowser.jsp, (12) classpath-debug.jsp, (13) viewdocument.jsp, or (14) cleancommentspam.jsp page; the (15) portletKey parameter to runportleterror.jsp; the (16) URI to issuelinksmall.jsp; the (17) afterURL parameter to screenshot-redirecter.jsp; or the (18) HTTP Referrer header to 500page.jsp, as exploited in the wild in April 2010.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1164?
CVE-2010-1164 is classified as a moderate severity vulnerability due to its nature allowing cross-site scripting attacks.
How do I fix CVE-2010-1164?
To fix CVE-2010-1164, you should upgrade Atlassian JIRA to the latest version that addresses these XSS vulnerabilities.
What are the affected versions in CVE-2010-1164?
CVE-2010-1164 affects Atlassian JIRA versions from 3.12 to 4.1, including specific subversions within that range.
What types of attacks does CVE-2010-1164 allow?
CVE-2010-1164 allows remote attackers to inject arbitrary web scripts or HTML, leading to potential phishing or data theft.
Is CVE-2010-1164 specific to any particular parameter?
Yes, CVE-2010-1164 exploits vulnerabilities through several parameters including element, defaultColor, and formName.