CVE-2021-39111 - Self-xss via copying content from a PDF

CVE-2021-39111
Rafal Lykowski
The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2 
allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the handling of supplied content 
such as from a PDF when pasted into a field such as the description field.

The affected versions are before version 8.5.18, from version 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2.

*Affected versions:*

    version < 8.5.18
    8.6.0 ≤ version < 8.13.10
    8.14.0 ≤ version < 8.18.2

*Fixed versions:*

    8.5.18
    8.13.10
    8.18.2
    8.19.0

Steps to reproduce:
0. Create PDF file with XSS payload (eg. <script>alert(localStorage.getItem('jira.issue.navigator.latest.search'))</script>).
1. Open PDF, copy created XSS payload.
2. Open Jira -> create new ticket -> go to 'Description' field.
3. Paste the XSS payload you copied from PDF file.
4. JS code should execute.