Details

      Description

      A user with username "><script>alert("foo")</script> that is linked to via [~username] markup results in script being executed.

      Curiously, viewing the space homepage of that user results in a blank page.

      This of course is prevented for public signup, but if the user gets created via other means, i.e. external user management, or via admin control panel then this is a valid point of attack

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              bnguyen Brian Nguyen
              Reporter:
              cbroadfoot Chris Broadfoot [Atlassian]
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: