CVE-2018-5230
30Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 38%
exploitation probability
38%top 2% of all CVEs
observed exploitation
nono source reports it
The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7.9.0 before version 7.9.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the error message of custom fields when an invalid value is specified.
Affected products
Atlassian · Jira