Loading...

XML

Word

Printable

Details

Type: Bug
Resolution: Fixed
Priority: High
Fix Version/s: 5.16.0
Affects Version/s: None
Component/s: None
Labels:

Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

Description

Similar to ~~JRASERVER-43422~~, the version of jQuery used (currently version 2.1.4) is vulnerable to jQuery issue 2432 (3rd party $.get() auto executes if content type is text/javascript) and 11974 (parseHTML executes inline scripts like event handlers). Actual exploitation / impact to Bitbucket Server depends upon if & how the vulnerable code paths are used.

On a related note, http://research.insecurelabs.org/jquery/test/ can be used to check jQuery versions for issues.

Attachments

Issue Links

is related to

BAM-19990 The versions of jQuery and jQuery UI in use are vulnerable to several issues

Closed

BSERV-10967 Update jQuery version bundled in Bitbucket.

Closed

relates to

JRASERVER-43422 Update the jQuery version used in Jira for better compatibility

Closed

SECURITY-54 Loading...

mentioned in: Page Loading...; Page Loading...; Page Loading...; Page Loading...

(3 mentioned in)

Activity

People

Assignee:: Deez Nutz (Inactive)

Reporter:: David Black

Votes:: 1 Vote for this issue

Watchers:: 13 Start watching this issue

Dates

Created:: 28/May/2018 12:30 AM

Updated:: 28/Mar/2022 8:09 PM

Resolved:: 15/Nov/2018 2:53 AM