CVE-2016-6285 : Cross-site scripting (XSS) vulnerability in includes/decorators/global-translati

Cross-site scripting (XSS) vulnerability in includes/decorators/global-translations.jsp in Atlassian JIRA before 7.2.2 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.

Published 2017-01-31 22:59:00

Updated 2017-02-03 16:10:28

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2016-6285

Atlassian » Jira
Versions up to, including, (<=) 7.2.1
cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2016-6285

EPSS FAQ

0.51%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 77 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-6285

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2016-6285

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-6285

http://seclists.org/fulldisclosure/2017/Jan/41

Full Disclosure: Reflected Cross-Site Scripting (XSS) in Atlassian Jira Software
Exploit;Third Party Advisory
http://www.securityfocus.com/bid/95913

Atlassian JIRA CVE-2016-6285 Cross Site Scripting Vulnerabiliy
Third Party Advisory;VDB Entry
http://packetstormsecurity.com/files/140548/Atlassian-Jira-7.1.7-Cross-Site-Scripting.html

Atlassian Jira 7.1.7 Cross Site Scripting ≈ Packet Storm
Exploit;Third Party Advisory
https://jira.atlassian.com/browse/JRA-61888?src=confmacro&_ga=1.139403892.63283854.1485351777

[JRASERVER-61888] XSS in /includes/decorators/global-translations.jsp - Create and track feature requests for Atlassian products.
Exploit;Vendor Advisory
https://confluence.atlassian.com/adminjira/jira-platform-releases/jira-7-2-x-platform-release-notes#JIRA7.2.xplatformreleasenotes-7-2-2

JIRA Core 7.2.x release notes - Atlassian Documentation
Release Notes

Jump to

Vulnerability Details : CVE-2016-6285

Products affected by CVE-2016-6285

Exploit prediction scoring system (EPSS) score for CVE-2016-6285

CVSS scores for CVE-2016-6285

CWE ids for CVE-2016-6285

References for CVE-2016-6285