Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-24773

XSS Vulnerability in Issue Links and Labels

XMLWordPrintable

      We have identified and fixed a number of cross-site scripting (XSS) vulnerabilities in JIRA issue links and labels.

      Affected versions are 4.2.x to 4.3.x

      XSS vulnerabilities potentially allow an attacker to embed their own JavaScript into a JIRA page. You can read more about XSS attacks at various places on the web, including these:

      This issue is reported in our security advisory on this page:

        1. JRA-24773-4.2.4-patch.md5
          0.1 kB
        2. JRA-24773-4.2.4-patch.zip
          8 kB
        3. JRA-24773-4.2.4-patch-instructions.txt
          2 kB
        4. JRA-24773-4.3.4-patch.md5
          0.1 kB
        5. JRA-24773-4.3.4-patch.zip
          12 kB
        6. JRA-24773-4.3.4-patch-instructions.txt
          2 kB

            [JRASERVER-24773] XSS Vulnerability in Issue Links and Labels

            Bugfix Automation Bot made changes -
            Minimum Version New: 4.02
            Owen made changes -
            Workflow Original: JAC Bug Workflow v2 [ 2842986 ] New: JAC Bug Workflow v3 [ 2910001 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v7 - Restricted [ 2577821 ] New: JAC Bug Workflow v2 [ 2842986 ]
            Status Original: Closed [ 6 ] New: Resolved [ 5 ]
            Ignat (Inactive) made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v6 - Restricted [ 1541748 ] New: JIRA Bug Workflow w Kanban v7 - Restricted [ 2577821 ]
            Confluence Escalation Bot (Inactive) made changes -
            Labels Original: advisory cvss-high security New: advisory affects-server cvss-high security
            Owen made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v6 [ 677295 ] New: JIRA Bug Workflow w Kanban v6 - Restricted [ 1541748 ]
            Security Metrics Bot made changes -
            Labels Original: advisory security New: advisory cvss-high security
            Oswaldo Hernandez (Inactive) made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v5 [ 642862 ] New: JIRA Bug Workflow w Kanban v6 [ 677295 ]
            Oswaldo Hernandez (Inactive) made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v5 [ 296349 ] New: JIRA Bug Workflow w Kanban v6 [ 642862 ]
            VitalyA made changes -
            Resolution New: Fixed [ 1 ]
            Status Original: Open [ 1 ] New: Closed [ 6 ]

              vosipov VitalyA
              pleschev Peter Leschev
              Affected customers:
              0 This affects my team
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: