Medium severity5.4NVD Advisory· Published Jul 1, 2020· Updated Jun 17, 2026

CVE-2020-4024

Description

The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a vnd.wap.xhtml+xml content type.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Atlassian/Jira
cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
Range: <8.5.5
Atlassian/Jira Data Center
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*
Range: >=8.6.0,<8.8.2
Atlassian/Jira Server
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
Range: >=8.6.0,<8.8.2
Atlassian/Jira Software Data Center
cpe:2.3:a:atlassian:jira_software_data_center:*:*:*:*:*:*:*:*
Range: <8.5.5
Atlassian/Crowd Data Center and Serverllm-fuzzy2 versions
<8.5.5, 8.6.0-<8.8.2, 8.9.0-<8.9.1+ 1 more
- (no CPE)range: <8.5.5, 8.6.0-<8.8.2, 8.9.0-<8.9.1
- (no CPE)range: unspecified

cvss	0.351
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

CVE-2020-4024

Description

AI Insight

Affected products

Patches

Vulnerability mechanics

References

News mentions