XMLWordPrintable

    Details

      Description

      NOTE: This bug report is for JIRA Server. Using JIRA Cloud? See the corresponding bug report.

      Jira Admins can create a persistant XSS on the Incoming Mail configuration page.

      When the value

      "><script>alert(1)</script> 
      

      is inserted into the Witelisted Domain field on the page

      /secure/admin/IncomingMailServers.jspa
      

      The javascript persists and executes on page load.

      This was tested on Jira version v7.1.9#71013-sha1:1aa0586

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              Unassigned Unassigned
              Reporter:
              aamrani Alek Amrani (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Dates

                Due:
                Created:
                Updated:
                Resolved: