[CONFSERVER-8950] XSS vulnerability in app/spaces/listattachmentforspace.action - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: High
Fix Version/s: 2.5.6, 2.6.0
Affects Version/s: 2.5.4
Component/s: None
Labels:
- affects-server
- editor
- security
- spaces
Environment:

Standalone

Bug Fix Policy:
View Atlassian Server bug fix policy

Description:
XSS via the "Filter By File Extension" field in app/spaces/listattachmentforspace.action.

Exploit:
blah"><script>alert(document.cookie)</script><x x="

was cloned as

CONFSERVER-8952 XSS vulnerability in app/pages/listpages-alphaview.action

Closed

Assignee:: Samuel Le Berrigaud

Reporter:: Gergely Hodicska

Affected customers:: 2 This affects my team

Watchers:: 1 Start watching this issue

Created:: 19/Jul/2007 12:41 PM

Updated:: 11/Oct/2018 9:09 AM

Resolved:: 26/Jul/2007 8:21 AM