NOTE: This bug report is for JIRA Server. Using JIRA Cloud? See the corresponding bug report.

      However, I am still investigating the original issue (JST-80496) but it seems there is a potential for XSS in Dashboard Gadgets.
      I was able to reproduce this on Firefox, Linux:

      So, access JIRA and login. Open a new tab and access the treasury.gov site. Use this same tab that has the treasury site opened to access JIRA.

      From my current investigation:

      • treasury.gov stores some user tracking data in window.name JS parameter. its value is passed across visits (and sites opened in the same tab)
      • gadgets are reading values from window.name and somehow its content is injected to the page

      cc: ohernandez@atlassian.com

            ohernandez@atlassian.com Oswaldo Hernandez (Inactive)
            mnowakowski Maciej Nowakowski
            0 Vote for this issue
            6 Start watching this issue