Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-21004

XSS and Privilege Escalation Vulnerabilities in JIRA

    XMLWordPrintable

Details

    Description

      We have identified and fixed vulnerabilities in JIRA which will allow an attacker to invoke XSS (Cross Site Scripting) attacks and/or obtain escalated account privileges potentially gaining access to the file system. Full details of the severity, risks and vulnerabilities can be found in the JIRA Security Advisory 2010-04-16.

      This patch supercedes both JRA-20994 and JRA-20995 with additional fixes and protection for your JIRA instance.

      We strongly recommend that all customers apply the attached patch immediately to address these vulnerabilities, even if you have already applied JRA-20994 and JRA-20995.

      Before applying the patch, please refer to the following documents, in this order:

      Patches

      Version File
      4.1 patch-JRA-21004-4.1.zip
      4.0.2 patch-JRA-21004-4.0.2.zip
      4.0.1 patch-JRA-21004-4.0.1.zip
      4.0 patch-JRA-21004-4.0.zip
      3.13.5 patch-JRA-21004-3.13.5.zip
      3.13.4 patch-JRA-21004-3.13.4.zip
      3.13.3 patch-JRA-21004-3.13.3.zip
      3.13.2 patch-JRA-21004-3.13.2.zip
      3.13.1 patch-JRA-21004-3.13.1.zip
      3.13 patch-JRA-21004-3.13.zip
      3.12.3 patch-JRA-21004-3.12.3.zip
      3.12.2 patch-JRA-21004-3.12.2.zip
      3.12.1 patch-JRA-21004-3.12.1.zip
      3.12 patch-JRA-21004-3.12.zip

      Attachments

        Issue Links

          details

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-21084 Quality Review for 4.1.2

          • Medium - Medium priority issues
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-21085 Quality Review for 4.2

          • Medium - Medium priority issues
          • Closed
          has a regression in

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-21063 Linked issues display incorrectly after applying security patch JRA-21004

          • Highest - Our top priority issues
          • Closed
          supersedes

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-20994 XSS Vulnerabilities in JIRA

          • Highest - Our top priority issues
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-20995 Privilege escalation vulnerability when administrator access is compromised

          • Highest - Our top priority issues
          • Closed

          Activity

            People

              Unassigned Unassigned
              bbaker ɹǝʞɐq pɐɹq
              Votes:
              0 Vote for this issue
              Watchers:
              21 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: