CVE-2025-67824: XSS
The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inject arbitrary HTML or JavaScript via XSS. This is exploited via a crafted payload placed in the name of a filter. This code is executed in the browser when the user attempts to create a timesheet with the filter timesheet type on the custom timesheet dialog because the filter name is not properly sanitized during the action.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67824?
CVE-2025-67824 is considered a high-severity vulnerability due to its ability to allow attackers to execute arbitrary HTML or JavaScript via XSS.
How do I fix CVE-2025-67824?
To fix CVE-2025-67824, update the WorklogPRO - Jira Timesheets plugin to version 4.24.2 or later.
What type of attack does CVE-2025-67824 enable?
CVE-2025-67824 enables cross-site scripting (XSS) attacks through crafted payloads in filter names.
Which versions of the WorklogPRO plugin are affected by CVE-2025-67824?
Versions before 4.24.2-jira9, 4.24.2-jira10, and 4.24.2-jira11 of the WorklogPRO plugin are affected by CVE-2025-67824.
What impact does CVE-2025-67824 have on users?
CVE-2025-67824 can compromise user data and security by allowing attackers to execute malicious scripts in user browsers.