CVE-2020-14169: 
JIRA vulnerability analysis and mitigation

The quick search component in Atlassian Jira Server and Data Center before version 8.9.1 contains a Cross-Site Scripting (XSS) vulnerability that allows remote attackers to inject arbitrary HTML or JavaScript. The vulnerability was discovered and assigned CVE-2020-14169, with disclosure on June 16, 2020 (CVE Details).

The vulnerability exists in the quick search component of Jira Server and Data Center. It allows remote attackers to perform cross-site scripting attacks by injecting malicious HTML or JavaScript code. The issue affects versions prior to 8.9.1 (Jira Issue).

If exploited, this vulnerability enables attackers to inject and execute arbitrary HTML or JavaScript code in the context of other users' browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions (CVE Details).

The vulnerability requires an attacker to have access to submit search queries to the affected Jira instance. No public exploits were confirmed at the time of disclosure (Jira Issue).

Atlassian has released fixed versions 8.9.1 and 8.10.0 to address this vulnerability. Users are advised to upgrade to these or later versions to mitigate the risk (Jira Issue).