description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapping vulnerability in the Project Shortcuts feature. The affected versions are before version 8.5.15, from version 8.6.0 before 8.13.7, from version 8.14.0 before 8.17.1, and from version 8.18.0 before 8.18.1.
problem types: CWE-1022: Use of Web Link to Untrusted Target with window.opener Access
affected:
{
product: Jira Server
vendor: Atlassian
versions:
lessThan: 8.5.15, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 8.6.0, versionType: custom
lessThan: 8.13.7, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 8.14.0, versionType: custom
lessThan: 8.17.1, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 8.18.0, versionType: custom
lessThan: 8.18.1, status: affected, version: unspecified, versionType: custom
}
{
product: Jira Data Center
vendor: Atlassian
versions:
lessThan: 8.5.15, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 8.6.0, versionType: custom
lessThan: 8.13.7, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 8.14.0, versionType: custom
lessThan: 8.17.1, status: affected, version: unspecified, versionType: custom
lessThan: unspecified, status: affected, version: 8.18.0, versionType: custom
lessThan: 8.18.1, status: affected, version: unspecified, versionType: custom
}
