Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-24773

XSS Vulnerability in Issue Links and Labels

XMLWordPrintable

      We have identified and fixed a number of cross-site scripting (XSS) vulnerabilities in JIRA issue links and labels.

      Affected versions are 4.2.x to 4.3.x

      XSS vulnerabilities potentially allow an attacker to embed their own JavaScript into a JIRA page. You can read more about XSS attacks at various places on the web, including these:

      This issue is reported in our security advisory on this page:

        1. JRA-24773-4.2.4-patch.md5
          0.1 kB
        2. JRA-24773-4.2.4-patch.zip
          8 kB
        3. JRA-24773-4.2.4-patch-instructions.txt
          2 kB
        4. JRA-24773-4.3.4-patch.md5
          0.1 kB
        5. JRA-24773-4.3.4-patch.zip
          12 kB
        6. JRA-24773-4.3.4-patch-instructions.txt
          2 kB

            [JRASERVER-24773] XSS Vulnerability in Issue Links and Labels

            VitalyA added a comment -

            4.1 is not vulnerable.

            VitalyA added a comment - 4.1 is not vulnerable.

            tier-0 grump added a comment -

            The previous patch files had issues - the instructions didn't include all of the files, and the md5 checksum was for the wrong zip.

            tier-0 grump added a comment - The previous patch files had issues - the instructions didn't include all of the files, and the md5 checksum was for the wrong zip.

            Patrick Gießler added a comment -

            The file JRA-24773-4.3.4-patch-instructions.txt describes that the patch contains 3 Files. The file JRA-24773-4.3.4-patch.zip includes 5 files. Is this correct?

            I've although a different md5-Checksum (49a358e66619cfc6f501b007bcfa403e).
            Is the md5-Checksum in the file 'JRA-24773-4.3.4-patch.md5' correct?

            Patrick Gießler added a comment - The file JRA-24773 -4.3.4-patch-instructions.txt describes that the patch contains 3 Files. The file JRA-24773 -4.3.4-patch.zip includes 5 files. Is this correct? I've although a different md5-Checksum (49a358e66619cfc6f501b007bcfa403e). Is the md5-Checksum in the file ' JRA-24773 -4.3.4-patch.md5' correct?

              vosipov VitalyA
              pleschev Peter Leschev
              Affected customers:
              0 This affects my team
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: