Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-21004

XSS and Privilege Escalation Vulnerabilities in JIRA

XMLWordPrintable

      We have identified and fixed vulnerabilities in JIRA which will allow an attacker to invoke XSS (Cross Site Scripting) attacks and/or obtain escalated account privileges potentially gaining access to the file system. Full details of the severity, risks and vulnerabilities can be found in the JIRA Security Advisory 2010-04-16.

      This patch supercedes both JRA-20994 and JRA-20995 with additional fixes and protection for your JIRA instance.

      We strongly recommend that all customers apply the attached patch immediately to address these vulnerabilities, even if you have already applied JRA-20994 and JRA-20995.

      Before applying the patch, please refer to the following documents, in this order:

      Patches

      Version File
      4.1 patch-JRA-21004-4.1.zip
      4.0.2 patch-JRA-21004-4.0.2.zip
      4.0.1 patch-JRA-21004-4.0.1.zip
      4.0 patch-JRA-21004-4.0.zip
      3.13.5 patch-JRA-21004-3.13.5.zip
      3.13.4 patch-JRA-21004-3.13.4.zip
      3.13.3 patch-JRA-21004-3.13.3.zip
      3.13.2 patch-JRA-21004-3.13.2.zip
      3.13.1 patch-JRA-21004-3.13.1.zip
      3.13 patch-JRA-21004-3.13.zip
      3.12.3 patch-JRA-21004-3.12.3.zip
      3.12.2 patch-JRA-21004-3.12.2.zip
      3.12.1 patch-JRA-21004-3.12.1.zip
      3.12 patch-JRA-21004-3.12.zip

        1. SysInfoPatch.png
          22 kB
          Bogdan Dziedzic [Atlassian]

            [JRASERVER-21004] XSS and Privilege Escalation Vulnerabilities in JIRA

            set-jac-bot made changes -
            Link New: This issue details JRASERVER-21084 [ JRASERVER-21084 ]
            set-jac-bot made changes -
            Link New: This issue details JRASERVER-21085 [ JRASERVER-21085 ]
            Owen made changes -
            Workflow Original: JAC Bug Workflow v2 [ 2843448 ] New: JAC Bug Workflow v3 [ 2927402 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v7 - Restricted [ 2578917 ] New: JAC Bug Workflow v2 [ 2843448 ]
            Ignat (Inactive) made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v6 - Restricted [ 1542468 ] New: JIRA Bug Workflow w Kanban v7 - Restricted [ 2578917 ]
            Oswaldo Hernandez (Inactive) made changes -
            Component/s New: Infrastructure & Services - Application Lifecycle [ 43324 ]
            Oswaldo Hernandez (Inactive) made changes -
            Labels Original: xss New: security xss
            Oswaldo Hernandez (Inactive) made changes -
            Component/s Original: Security [Deprecated] [ 11831 ]
            Owen made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v6 [ 680014 ] New: JIRA Bug Workflow w Kanban v6 - Restricted [ 1542468 ]
            Oswaldo Hernandez (Inactive) made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v5 [ 663180 ] New: JIRA Bug Workflow w Kanban v6 [ 680014 ]

              Unassigned Unassigned
              bbaker ɹǝʞɐq pɐɹq
              Affected customers:
              0 This affects my team
              Watchers:
              21 Start watching this issue

                Created:
                Updated:
                Resolved: