CVE-2017-14594
Last modified
CVE-2017-14594 is a vulnerability of currently unknown severity. The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jqlQuery query parameter.. EPSS estimates a 1.04% chance of exploitation in the next 30 days.
Description
The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jqlQuery query parameter.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Jira | < 7.2.12 |
| Atlassian | Jira Server | >= 7.3.0, < 7.6.1 |
References
- https://jira.atlassian.com/browse/JRASERVER-66495Patch, Vendor Advisory
- https://jira.atlassian.com/browse/JRASERVER-66495Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-14594?
How severe is CVE-2017-14594?
How do I fix CVE-2017-14594?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-14589It was possible for double OGNL evaluation in FreeMarker tem…
- CVE-2017-1459IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specif…
- CVE-2017-14590Bamboo did not check that the name of a branch in a Mercuria…
- CVE-2017-14591Atlassian Fisheye and Crucible versions less than 4.4.3 and …
- CVE-2017-14592Sourcetree for macOS had several argument and command inject…
- CVE-2017-14593Sourcetree for Windows had several argument and command inje…
- CVE-2017-14595In Joomla! before 3.8.0, a logic bug in a SQL query could le…
- CVE-2017-14596In Joomla! before 3.8.0, inadequate escaping in the LDAP aut…
- CVE-2017-14597AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XS…
- CVE-2017-1460IBM i OSPF 6.1, 7.1, 7.2, and 7.3 is vulnerable when a rogue…
- CVE-2017-14600Pragyan CMS v3.0 is vulnerable to an Error-Based SQL injecti…
- CVE-2017-14601Pragyan CMS v3.0 is vulnerable to a Boolean-based SQL inject…
Are you affected by CVE-2017-14594?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST