Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-61963

XSS in Mail Whitelist Field

    XMLWordPrintable

Details

    Description

      NOTE: This bug report is for JIRA Server. Using JIRA Cloud? See the corresponding bug report.

      Jira Admins can create a persistant XSS on the Incoming Mail configuration page.

      When the value 

      "><script>alert(1)</script>

      is inserted into the Witelisted Domain field on the page 

      /secure/admin/IncomingMailServers.jspa

      The javascript persists and executes on page load.

      This was tested on Jira version v7.1.9#71013-sha1:1aa0586

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. JRACLOUD-61963 XSS in Mail Whitelist Field

          • Low - Low priority issues
          • Closed

          HELIX-462 Loading...

          JSB-142 Loading...

          Activity

            People

              Unassigned Unassigned
              aamrani Alek Amrani (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: