CVE-2020-14166: XSS
The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-14166?
CVE-2020-14166 is a Cross Site Scripting (XSS) vulnerability in Jira Service Desk Server and Data Center before version 4.10.0.
How does CVE-2020-14166 affect Jira Service Desk?
CVE-2020-14166 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an XSS vulnerability by uploading an HTML file.
What is the severity of CVE-2020-14166?
CVE-2020-14166 has a severity rating of 4.8, which is considered medium.
How can I fix CVE-2020-14166?
To fix CVE-2020-14166, you should upgrade Jira Service Desk Server and Data Center to version 4.10.0 or later.
Where can I find more information about CVE-2020-14166?
You can find more information about CVE-2020-14166 at the following references: [Packetstorm Security](http://packetstormsecurity.com/files/162107/Atlassian-Jira-Service-Desk-4.9.1-Cross-Site-Scripting.html) and [Atlassian Jira Issue](https://jira.atlassian.com/browse/JSDSERVER-6895).