CVE-2020-14166

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-07-01 · updated 2026-06-17
Weakness: CWE-79

Description

The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.

Affected products

Atlassian Jira Service Desk Server: before 4.10.0 — fixed in 4.10.0

How to fix

Upgrade to a fixed version: Atlassian Jira Service Desk Server 4.10.0. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/162107/Atlassian-Jira-Service-Desk-4.9.1-Cross-Site-Scripting.html
https://jira.atlassian.com/browse/JSDSERVER-6895
http://packetstormsecurity.com/files/162107/Atlassian-Jira-Service-Desk-4.9.1-Cross-Site-Scripting.html
https://jira.atlassian.com/browse/JSDSERVER-6895

Get alerted when CVE-2020-14166 or the next vulnerability affects your stack