XSS in Mail Whitelist Field

XMLWordPrintable

    • Severity 3 - Minor

      NOTE: This bug report is for JIRA Cloud. Using JIRA Server? See the corresponding bug report.

      Jira Admins can create a persistant XSS on the Incoming Mail configuration page.

      When the value 

      "><script>alert(1)</script>

      is inserted into the Witelisted Domain field on the page 

      /secure/admin/IncomingMailServers.jspa

      The javascript persists and executes on page load.

      This was tested on Jira version v7.1.9#71013-sha1:1aa0586

            Assignee:
            Oswaldo Hernandez (Inactive)
            Reporter:
            Alek Amrani (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: