The 'name' param in jira-components/jira-webapp/src/main/webapp/secure/admin/user/views/deleteuserconfirm.jsp is not sanitised, enabling arbitrary html/script execution.
      A url to demonstrate this issue is: http://localhost:8080/secure/admin/user/DeleteUser!default.jspa?name=a"><script>alert(document.cookie);</script>&returnUrl=UserBrowser.jspa

            [JRASERVER-34160] Reflected XSS in JIRA Admin Panel (Delete User)

            RahimK added a comment - - edited

            .

            RahimK added a comment - - edited .

            Sirisha Bhupathiraju added a comment - - edited

            Is this bug in JIRA versions 5.2.x, particularly - 5.2.11?? Or does it affect only versions 6.0.2 and 6.0.3?

            Sirisha Bhupathiraju added a comment - - edited Is this bug in JIRA versions 5.2.x, particularly - 5.2.11?? Or does it affect only versions 6.0.2 and 6.0.3?

              Unassigned Unassigned
              dbdca3d7c582 Gjoko Krstic
              Affected customers:
              0 This affects my team
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: