Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-31709

Reflected XSS in Create Issue Details page

    XMLWordPrintable

Details

    Description

      NOTE: This bug report is for JIRA Server. Using JIRA Cloud? See the corresponding bug report.

      (filed by vosipov on behalf of a customer) See the original issue. According to my testing a custom field of type "datepicker" accepts any text, including script and will reflect it back unfiltered in case of an error on the page (e.g. not all fields filled in).

      Tested on the latest OnDemand instance. Sample code after injection into customfield_10102

       <div class="field-group aui-field-datepicker" >
                  <label for="customfield_10102">datepicker</label>
                  <input class="text medium-field datepicker-input" id="customfield_10102" name="customfield_10102" type="text" value=">">
                  <script>alert(xss)</script>
                  <"" />
                  <a href="#" id="customfield_10102-trigger" title="Select a date">
                    <span class="aui-icon icon-date">Select a date</span>
                  </a>

      Attachments

        Issue Links

          is cloned from

          Bug - A problem which impairs or prevents the functions of the product. JRASERVER-30039 Reflected XSS in Create Issue Details page

          • High - High priority issues
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. JRACLOUD-31709 Reflected XSS in Create Issue Details page

          • High - High priority issues
          • Closed

          Activity

            People

              edalgliesh Eric Dalgliesh
              19413d2c1189 Xsite GmbH
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: