CVE-2019-8450

4.8 mediumEPSS 0.9%

Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a custom field.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2019-09-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

atlassian:jira_server

References

https://jira.atlassian.com/browse/JRASERVER-69795
https://jira.atlassian.com/browse/JRASERVER-69795

Check your stack JSON