CVE-2020-14166 EXPLOIT
4.8
MEDIUM · CVSS 3.1 · EPSS 1.9% (pctl 80)
Patch early
A public exploit exists.
Description
The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.
Scoring
| CVSS | 4.8 (MEDIUM, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| EPSS | 1.94% — more likely to be exploited than 80% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2020-07-01 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| atlassian | jira service desk |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Atlassian Jira Service Desk 4.9.1 - Unrestricted File Upload to XSS | 2021-04-07 |
References
- http://packetstormsecurity.com/files/162107/Atlassian-Jira-Service-Desk-4.9.1-Cross-Site-Scripting.html
- https://jira.atlassian.com/browse/JSDSERVER-6895
- http://packetstormsecurity.com/files/162107/Atlassian-Jira-Service-Desk-4.9.1-Cross-Site-Scripting.html
- https://jira.atlassian.com/browse/JSDSERVER-6895
→ the Explorer · watch your stack · NVD