4.3
CVSSv2

CVE-2018-5230

Published: 14/05/2018 Updated: 19/06/2018
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Summary

The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7.9.0 before version 7.9.2 allows remote malicious users to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the error message of custom fields when an invalid value is specified.

Vulnerability Trend

Affected Products

Vendor Product Versions
AtlassianJira-, 2.1, 2.2, 2.2.1, 2.3, 2.4.1, 2.5.1, 2.5.2, 2.5.3, 2.6, 2.6.1, 3.0, 3.0.1, 3.0.2, 3.0.3, 3.1, 3.1.1, 3.2, 3.2.1, 3.2.2, 3.2.3, 3.3, 3.3.1, 3.3.2, 3.3.3, 3.4, 3.4.1, 3.4.2, 3.4.3, 3.5, 3.5.1, 3.5.2, 3.5.3, 3.6, 3.6.1, 3.6.2, 3.6.2 156, 3.6.3, 3.6.4, 3.6.5, 3.7, 3.7.1, 3.7.2, 3.7.3, 3.7.4, 3.8, 3.8.1, 3.9, 3.9.1, 3.9.2, 3.9.3, 3.10, 3.10.1, 3.10.2, 3.11, 3.12, 3.12.1, 3.12.2, 3.12.3, 3.13, 3.13.1, 3.13.2, 3.13.3, 3.13.4, 3.13.5, 4.0, 4.0.1, 4.0.2, 4.1, 4.1.1, 4.1.2, 4.2, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.4, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.1, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.1.7, 5.1.8, 5.2, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.4.1, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.2, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.3, 6.3.1, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.3.15, 6.4, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.4.12, 6.4.13, 6.4.14, 7.0.0, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.9, 7.0.10 , 7.0.11, 7.1.0, 7.1.1, 7.1.2, 7.1.4, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.2.11, 7.2.12, 7.2.13, 7.2.14, 7.2.15, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 7.4.0, 7.4.1, 7.4.2, 7.4.3, 7.4.4, 7.4.5, 7.4.6, 7.5.0, 7.5.1, 7.5.2, 7.5.3, 7.5.4, 7.6.0, 7.6.1, 7.6.2, 7.6.3, 7.6.4, 7.6.5, 7.7.0, 7.7.1, 7.7.2, 7.7.3, 7.8.0, 7.8.1, 7.8.2, 7.8.3, 7.9.0, 7.9.1

Github Repositories

master 1 branch 43 tags Go to file Code Clone with HTTPS Use Git or checkout with SVN using the web URL. Download ZIP Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Go back Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Go back Launching Xcode If nothing happens, download Xcode and try again. Go back Launching Visual Studio If nothing happens, download the GitHub extension for Visual Studio and try again. Go back Latest commit bauthard Adding template details. … Loading status checks… c429207 5 minutes ago Adding template details. c429207 Git stats 814 commits Files Permalink Failed to load latest commit information. Type Name Latest commit message Commit time .github/workflows Check all branches during syntax linting 3 months ago basic-detections adding condition 28 days ago brute-force Update tomcat-manager-bruteforce.yaml 4 days ago cves Update CVE-2017-9841.yaml 23 hours ago dns uniform severity update 4 days ago files Update wadl-files.yaml 2 days ago panels uniform severity update 4 days ago payloads Add dedicated payloads dir - CVE-2020-6287 18 days ago security-misconfiguration Update wamp-xdebug-detect.yaml 5 days ago subdomain-takeover Update detect-all-takeovers.yaml 4 days ago technologies tech updates 10 hours ago tokens syntax update 8 days ago vulnerabilities Improve shellshock payload 2 days ago workflows SAP NetWeaver Workflow 18 days ago .gitignore Update .gitignore 10 days ago .pre-commit-config.yaml Add pre-commit and yamllint configuration 3 months ago .yamllint Fixed linting rules for more relaxed 3 months ago LICENSE Create LICENSE 4 months ago README.md Adding template details. 5 minutes ago View code README.md Templates are the core of nuclei scanner which power the actual scanning engine. This repository stores and houses various templates for the scanner provided by our team as well as contributed by the community. We hope that you also contribute by sending templates via pull requests and grow the list. Template Directory ├── LICENSE ├── README.md ├── basic-detections │   ├── basic-xss-prober.yaml │   └── general-tokens.yaml ├── brute-force │   └── tomcat-manager-bruteforce.yaml ├── cves │   ├── CVE-2017-10075.yaml │   ├── CVE-2017-7529.yaml │   ├── CVE-2017-9506.yaml │   ├── CVE-2017-9841.yaml │   ├── CVE-2018-0296.yaml │   ├── CVE-2018-1000129.yaml │   ├── CVE-2018-11409.yaml │   ├── CVE-2018-11759.yaml │   ├── CVE-2018-1247.yaml │   ├── CVE-2018-1271.yaml │   ├── CVE-2018-13379.yaml │   ├── CVE-2018-14728.yaml │   ├── CVE-2018-16341.yaml │   ├── CVE-2018-18069.yaml │   ├── CVE-2018-19439.yaml │   ├── CVE-2018-20824.yaml │   ├── CVE-2018-2791.yaml │   ├── CVE-2018-3714.yaml │   ├── CVE-2018-3760.yaml │   ├── CVE-2018-5230.yaml │   ├── CVE-2018-7490.yaml │   ├── CVE-2019-10475.yaml │   ├── CVE-2019-11510.yaml │   ├── CVE-2019-12314.yaml │   ├── CVE-2019-14322.yaml │   ├── CVE-2019-14974.yaml │   ├── CVE-2019-15043.yaml │   ├── CVE-2019-16759.yaml │   ├── CVE-2019-17382.yaml │   ├── CVE-2019-18394.yaml │   ├── CVE-2019-19368.yaml │   ├── CVE-2019-19781.yaml │   ├── CVE-2019-19908.yaml │   ├── CVE-2019-19985.yaml │   ├── CVE-2019-2588.yaml │   ├── CVE-2019-3396.yaml │   ├── CVE-2019-3799.yaml │   ├── CVE-2019-5418.yaml │   ├── CVE-2019-8449.yaml │   ├── CVE-2019-8451.yaml │   ├── CVE-2019-8903.yaml │   ├── CVE-2019-8982.yaml │   ├── CVE-2020-10199.yaml │   ├── CVE-2020-10204.yaml │   ├── CVE-2020-1147.yaml │   ├── CVE-2020-12720.yaml │   ├── CVE-2020-13167.yaml │   ├── CVE-2020-2096.yaml │   ├── CVE-2020-3187.yaml │   ├── CVE-2020-3452.yaml │   ├── CVE-2020-5284.yaml │   ├── CVE-2020-5405.yaml │   ├── CVE-2020-5410.yaml │   ├── CVE-2020-5902.yaml │   ├── CVE-2020-6287.yaml │   ├── CVE-2020-7209.yaml │   ├── CVE-2020-7961.yaml │   ├── CVE-2020-8091.yaml │   ├── CVE-2020-8115.yaml │   ├── CVE-2020-8191.yaml │   ├── CVE-2020-8193.yaml │   ├── CVE-2020-8194.yaml │   ├── CVE-2020-8512.yaml │   ├── CVE-2020-8982.yaml │   ├── CVE-2020-9484.yaml │   └── CVE-2020-9757.yaml ├── dns │   ├── azure-takeover-detection.yaml │   ├── cname-service-detector.yaml │   ├── dead-host-with-cname.yaml │   └── servfail-refused-hosts.yaml ├── files │   ├── apc-info.yaml │   ├── cgi-test-page.yaml │   ├── debug-pprof.yaml │   ├── dir-listing.yaml │   ├── docker-registry.yaml │   ├── drupal-install.yaml │   ├── elasticsearch.yaml │   ├── exposed-kibana.yaml │   ├── exposed-svn.yaml │   ├── filezilla.yaml │   ├── firebase-detect.yaml │   ├── git-config.yaml │   ├── htaccess-config.yaml │   ├── jkstatus-manager.yaml │   ├── jolokia.yaml │   ├── laravel-env.yaml │   ├── lazy-file.yaml │   ├── phpinfo.yaml │   ├── public-tomcat-instance.yaml │   ├── security.txt.yaml │   ├── server-status-localhost.yaml │   ├── telerik-dialoghandler-detect.yaml │   ├── telerik-fileupload-detect.yaml │   ├── tomcat-scripts.yaml │   ├── wadl-files.yaml │   ├── web-config.yaml │   ├── wordpress-directory-listing.yaml │   ├── wordpress-user-enumeration.yaml │   ├── wp-xmlrpc.yaml │   └── zip-backup-files.yaml ├── panels │   ├── atlassian-crowd-panel.yaml │   ├── cisco-asa-panel.yaml │   ├── citrix-adc-gateway-detect.yaml │   ├── compal.yaml │   ├── crxde.yaml │   ├── docker-api.yaml │   ├── fortinet-fortigate-panel.yaml │   ├── globalprotect-panel.yaml │   ├── grafana-detect.yaml │   ├── jenkins-asyncpeople.yaml │   ├── jmx-console.yaml │   ├── kubernetes-pods.yaml │   ├── mongo-express-web-gui.yaml │   ├── parallels-html-client.yaml │   ├── phpmyadmin-panel.yaml │   ├── pulse-secure-panel.yaml │   ├── rabbitmq-dashboard.yaml │   ├── sap-netweaver-detect.yaml │   ├── sap-recon-detect.yaml │   ├── sophos-fw-version-detect.yaml │   ├── supervpn-panel.yaml │   ├── swagger-panel.yaml │   ├── tikiwiki-cms.yaml │   ├── weave-scope-dashboard-detect.yaml │   └── webeditors.yaml ├── payloads │   └── CVE-2020-6287.xml ├── security-misconfiguration │   ├── basic-cors-flash.yaml │   ├── basic-cors.yaml │   ├── front-page-misconfig.yaml │   ├── jira-service-desk-signup.yaml │   ├── jira-unauthenticated-dashboards.yaml │   ├── jira-unauthenticated-popular-filters.yaml │   ├── jira-unauthenticated-projects.yaml │   ├── jira-unauthenticated-user-picker.yaml │   ├── rabbitmq-default-admin.yaml │   ├── rack-mini-profiler.yaml │   ├── springboot-detect.yaml │   └── wamp-xdebug-detect.yaml ├── subdomain-takeover │   ├── detect-all-takeovers.yaml │   └── s3-subtakeover.yaml ├── technologies │   ├── bigip-config-utility-detect.yaml │   ├── citrix-vpn-detect.yaml │   ├── clockwork-php-page.yaml │   ├── couchdb-detect.yaml │   ├── github-enterprise-detect.yaml │   ├── gitlab-detect.yaml │   ├── graphql.yaml │   ├── home-assistant.yaml │   ├── jaspersoft-detect.yaml │   ├── jira-detect.yaml │   ├── liferay-portal-detect.yaml │   ├── linkerd-badrule-detect.yaml │   ├── linkerd-ssrf-detect.yaml │   ├── netsweeper-webadmin-detect.yaml │   ├── ntlm-directories.yaml │   ├── prometheus-exposed-panel.yaml │   ├── s3-detect.yaml │   ├── sap-netweaver-as-java-detect.yaml │   ├── sap-netweaver-detect.yaml │   ├── sql-server-reporting.yaml │   ├── tech-detect.yaml │   ├── weblogic-detect.yaml │   └── werkzeug-debugger-detect.yaml ├── tokens │   ├── amazon-mws-auth-token-value.yaml │   ├── aws-access-key-value.yaml │   ├── google-api-key.yaml │   ├── http-username-password.yaml │   ├── mailchimp-api-key.yaml │   └── slack-access-token.yaml ├── vulnerabilities │   ├── cached-aem-pages.yaml │   ├── couchdb-adminparty.yaml │   ├── crlf-injection.yaml │   ├── discourse-xss.yaml │   ├── git-config-nginxoffbyslash.yaml │   ├── ibm-infoprint-directory-traversal.yaml │   ├── microstrategy-ssrf.yaml │   ├── moodle-filter-jmol-lfi.yaml │   ├── moodle-filter-jmol-xss.yaml │   ├── nginx-module-vts-xss.yaml │   ├── open-redirect.yaml │   ├── oracle-ebs-bispgraph-file-access.yaml │   ├── pdf-signer-ssti-to-rce.yaml │   ├── rce-shellshock-user-agent.yaml │   ├── rce-via-java-deserialization.yaml │   ├── springboot-actuators-jolokia-xxe.yaml │   ├── symfony-debugmode.yaml │   ├── tikiwiki-reflected-xss.yaml │   ├── tomcat-manager-pathnormalization.yaml │   ├── twig-php-ssti.yaml │   ├── wordpress-duplicator-path-traversal.yaml │   ├── wordpress-wordfence-xss.yaml │   └── x-forwarded-host-injection.yaml └── workflows ├── bigip-pwner-workflow.yaml ├── jira-exploitaiton-workflow.yaml ├── liferay-rce-workflow.yaml ├── netsweeper-preauth-rce-workflow.yaml ├── rabbitmq-workflow.yaml ├── sap-netweaver-workflow.yaml └── springboot-pwner-workflow.yaml 13 directories, 204 templates. Please navigate to https://nuclei.projectdiscovery.io for detailed documentation to build new and your own custom templates and many example templates for easy understanding. Notes: Use YAMLlint (e.g. yamllint) to validate new templates when sending pull requests. Use YAML Formatter (e.g. jsonformatter) to format new templates when sending pull requests. Thanks again for your contribution and keeping the community vibrant. About Community curated list of template files for the nuclei engine to find security vulnerability and fingerprinting the targets. github.com/projectdiscovery/nuclei Topics nuclei-templates nuclei bugbounty security content-bruteforcing Resources Readme License MIT License Releases 43 v4.0.2 Latest 22 hours ago + 42 releases Contributors 67 + 56 contributors