CVE-2017-18039: Atlassian Jira

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the messagesThreshold parameter.

Affected products

• Atlassian Jira: from 6.2.1, before 7.4.4 (fixed in 7.4.4)

Published 2018-02-02. Last modified 2026-06-17.