{"uuid": "2cdcf979-bc32-4a6f-b718-9cdce9ddfcf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-14166", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/4061", "content": "Exploit Collector\nAtlassian Jira Service Desk 4.9.1 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-nGXsE6SnJzg/WWlu_4hmLPI/AAAAAAAAIKI/Orx5Bzmw2Dg1C2Ys8CQM09j0YgXq__7zgCLcBGAs/s1600/h120.png \nAtlassian Jira Service Desk version 4.9.1 suffers from a cross site scripting vulnerability via a file upload.\n\nMD5 | 840e289057a75abee3ebef734b12ec0a\n\nDownload\n# Exploit Title: Atlassian Jira Service Desk 4.9.1 - Unrestricted File Upload to XSS\n# Date: 07 Mar 2020\n# Exploit Author: Captain_hook\n# Vendor Homepage: https://www.atlassian.com/\n# Version: < 4.10.0\n# Tested on: All OS\n# CVE: CVE-2020-14166\n\nSummary:\n\nThe /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.\n\nSteps to reproduce:\n\n1- reach to this directory http://localhost:port/servicedesk/customer/portals?customize=true\n2- There's a place where the banner can be uploaded when upload wizard popup you can see that the banner image restricted to image format, you can change that type easily\n3- then you can upload HTML and javascript files and hijacking cookies or XSRF tokens.\n\nOriginal report in bugcrowd:\n\nhttps://bugcrowd.com/disclosures/61a50171-aa55-4126-b9f4-4e82b4b8c301/unrestricted-file-upload-stored-xss-for-token-hijacking\nOriginal ticket in atlassian:\n\nhttps://jira.atlassian.com/browse/JSDSERVER-6895?error=login_required&error_description=Login+required&state=28f8e754-fb05-4f5e-adda-79e252fe2c30\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-09T00:00:31.438235Z"}