Details

    Description

      A user with username "><script>alert("foo")</script> that is linked to via [~username] markup results in script being executed.

      Curiously, viewing the space homepage of that user results in a blank page.

      This of course is prevented for public signup, but if the user gets created via other means, i.e. external user management, or via admin control panel then this is a valid point of attack

      Attachments

        Issue Links

          Activity

            People

              bnguyen Brian Nguyen (Inactive)
              cbroadfoot Chris Broadfoot [Atlassian]
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: