Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-11002

viewuser.action has an XSS problem around username

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Medium Medium
    • 2.7.3
    • 2.1.5, 2.2.10, 2.3.3, 2.4.5, 2.5.8, 2.6.2, 2.7.2
    • None

      Steps to reproduce:

      1. create a user with username: foo"><script>alert('hello');</script><span class="ff
      2. you should get an alert when you are redirected to viewuser.action to view the user you just created.

        1. viewuser.vm
          7 kB
          Chris Broadfoot [Atlassian]

            [CONFSERVER-11002] viewuser.action has an XSS problem around username

            Katherine Yabut made changes -
            Workflow Original: JAC Bug Workflow v3 [ 2877741 ] New: CONFSERVER Bug Workflow v4 [ 2985454 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow v2 [ 2778083 ] New: JAC Bug Workflow v3 [ 2877741 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow [ 2716293 ] New: JAC Bug Workflow v2 [ 2778083 ]
            Owen made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2382385 ] New: JAC Bug Workflow [ 2716293 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 2275221 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2382385 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2218050 ] New: Confluence Workflow - Public Facing - Restricted v5 [ 2275221 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2171703 ] New: Confluence Workflow - Public Facing - Restricted v5.1 - TEMP [ 2218050 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v5 [ 1933086 ] New: Confluence Workflow - Public Facing - Restricted v5 - TEMP [ 2171703 ]
            Katherine Yabut made changes -
            Workflow Original: Confluence Workflow - Public Facing - Restricted v3 [ 1732895 ] New: Confluence Workflow - Public Facing - Restricted v5 [ 1933086 ]
            Katherine Yabut made changes -
            Workflow Original: CONF Bug Subtask WF (TEMP) [ 1691504 ] New: Confluence Workflow - Public Facing - Restricted v3 [ 1732895 ]

              cbroadfoot Chris Broadfoot [Atlassian]
              dave@atlassian.com dave (Inactive)
              Affected customers:
              0 This affects my team
              Watchers:
              0 Start watching this issue

                Created:
                Updated:
                Resolved: