However, I am still investigating the original issue (JST-80496) but it seems there is a potential for XSS in Dashboard Gadgets.
I was able to reproduce this on Firefox, Linux:
So, access JIRA and login. Open a new tab and access the treasury.gov site. Use this same tab that has the treasury site opened to access JIRA.
From my current investigation:
- treasury.gov stores some user tracking data in window.name JS parameter. its value is passed across visits (and sites opened in the same tab)
- gadgets are reading values from window.name and somehow its content is injected to the page