An authenticated stored cross-site scripting (XSS) vulnerability in The Plugin People Enterprise Mail Handler for Jira Data Center (JEMH) before v4.1.69-dc allows attackers with Administrator privileges to execute arbitrary Javascript in context of a user's browser via injecting a crafted payload into the HTML field of a template.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/florkie/CVE/blob/main/CVE-2025-25363.md | Third Party Advisory |
| https://marketplace.atlassian.com/apps/4832/enterprise-mail-handler-for-jira-jemh/version-history?versionHistoryHosting=dataCenter | Release Notes |
Configurations
History
03 Apr 2025, 16:43
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Thepluginpeople enterprise Mail Handler
Thepluginpeople |
|
| CPE | cpe:2.3:a:thepluginpeople:enterprise_mail_handler:*:*:*:*:*:jira:*:* | |
| References | () https://marketplace.atlassian.com/apps/4832/enterprise-mail-handler-for-jira-jemh/version-history?versionHistoryHosting=dataCenter - Release Notes | |
| References | () https://github.com/florkie/CVE/blob/main/CVE-2025-25363.md - Third Party Advisory |
13 Mar 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-13 18:15
Updated : 2025-04-03 16:43
NVD link : CVE-2025-25363
Mitre link : CVE-2025-25363
JSON object : View
Products Affected
thepluginpeople
- enterprise_mail_handler
CWE
No CWE.