CVE-2018-13387
Estado: ModificadaMedia (6.1)—
The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3 and from version 7.10.0 before version 7.10.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the messagesThreshold parameter as the fix for CVE-2017-18039 was incomplete.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Puntuación base: 6.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.45%
- Percentil entre todas las CVEs puntuadas: 73
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-79
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2018-13387",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "CHANGED",
"version": "3.0",
"baseScore": 6.1,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security@atlassian.com",
"affectedData": [
{
"vendor": "Atlassian",
"product": "Jira",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.6.7",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.7.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.7.5",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.8.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.8.5",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.9.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.9.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.10.0",
"lessThan": "unspecified",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "7.10.2",
"versionType": "custom"
}
]
}
]
}
],
"published": "2018-07-16T13:29:00.347",
"references": [
{
"url": "http://www.securityfocus.com/bid/104890",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security@atlassian.com"
},
{
"url": "https://jira.atlassian.com/browse/JRASERVER-67526",
"tags": [
"Vendor Advisory"
],
"source": "security@atlassian.com"
},
{
"url": "http://www.securityfocus.com/bid/104890",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://jira.atlassian.com/browse/JRASERVER-67526",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3 and from version 7.10.0 before version 7.10.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the messagesThreshold parameter as the fix for CVE-2017-18039 was incomplete."
},
{
"lang": "es",
"value": "El recurso IncomingMailServers en Atlassian JIRA Server en versiones anteriores a la 7.6.7, desde la versión 7.7.0 antes de la 7.7.5, desde la versión 7.8.0 antes de la 7.8.5, desde la versión 7.9.0 antes de la 7.9.3 y desde la versión 7.10.0 antes de la 7.10.2 permite que atacantes remotos inyecten HTML o JavaScript arbitrarios mediante una vulnerabilidad Cross-Site Scripting (XSS) en el parámetro messagesThreshold, ya que la solución para CVE-2017-18039 estaba incompleta."
}
],
"lastModified": "2026-06-17T01:39:19.213",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9F0C2FA0-B59B-441B-B6EC-5A0D79491FBE",
"versionEndExcluding": "7.6.7"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "300D871F-7128-41F1-BCC8-BE7C3687741B",
"versionEndExcluding": "7.7.5",
"versionStartIncluding": "7.7.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A04E4050-271E-4D23-B988-E02D5A651386",
"versionEndExcluding": "7.8.5",
"versionStartIncluding": "7.8.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2A3C3F9E-5BDD-48F3-B45F-9B9C6D31CAE2",
"versionEndExcluding": "7.9.3",
"versionStartIncluding": "7.9.0"
},
{
"criteria": "cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7F8167EC-30D3-4C10-AD1F-003FD0CBB5BC",
"versionEndExcluding": "7.10.2",
"versionStartIncluding": "7.10.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@atlassian.com"
}