CVE-2018-20232

The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the rendering of retrieved content from a url location that could be manipulated by the up_projectid widget preference setting.

• CWE-79

• http://www.securityfocus.com/bid/107023Third Party Advisory, VDB Entry
• https://jira.atlassian.com/browse/JRASERVER-68614Vendor Advisory
• http://www.securityfocus.com/bid/107023Third Party Advisory, VDB Entry
• https://jira.atlassian.com/browse/JRASERVER-68614Vendor Advisory

Published

Feb 13, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-20226An organization administrator can add a super administrator …
• CVE-2018-20227RDF4J 2.4.2 allows Directory Traversal via ../ in an entry i…7.5
• CVE-2018-20228Subsonic V6.1.5 allows internetRadioSettings.view streamUrl …
• CVE-2018-20229GitLab Community and Enterprise Edition before 11.3.14, 11.4…
• CVE-2018-20230An issue was discovered in PSPP 1.2.0. There is a heap-based…
• CVE-2018-20231Cross Site Request Forgery (CSRF) in the two-factor-authenti…
• CVE-2018-20233The Upload add-on resource in Atlassian Universal Plugin Man…
• CVE-2018-20234There was an argument injection vulnerability in Atlassian S…
• CVE-2018-20235There was an argument injection vulnerability in Atlassian S…
• CVE-2018-20236There was an command injection vulnerability in Sourcetree f…
• CVE-2018-20237Atlassian Confluence Server and Data Center before version 6…6.5
• CVE-2018-20238Various rest resources in Atlassian Crowd before version 3.2…