CVE-2020-4022: The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or ...

Summary

The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a mixed multipart cont...

What to do

Update atlassian jira to version 8.5.5 or later.
Update atlassian jira_software_data_center to version 8.5.5 or later.

Affected software

Vendor	Product	Affected versions
atlassian	jira	< 8.5.5 `cpe:2.3:a:atlassian:jira::::::::`
atlassian	jira_data_center	>= 8.6.0, < 8.8.2 >= 8.9.0, < 8.9.1 `cpe:2.3:a:atlassian:jira_data_center::::::::`
atlassian	jira_server	>= 8.6.0, < 8.8.2 >= 8.9.0, < 8.9.1 `cpe:2.3:a:atlassian:jira_server::::::::`
atlassian	jira_software_data_center	< 8.5.5 `cpe:2.3:a:atlassian:jira_software_data_center::::::::`

Original advisory text

The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or ...

The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a mixed multipart content type.

References

https://jira.atlassian.com/browse/JRASERVER-71107 Vendor Advisory