• Type: Bug
• Resolution: Fixed
• Priority: Low (View bug fix roadmap)
• Fix Version/s: 7.1.9, Available in Jira Cloud
• Affects Version/s: None
• Component/s: Project Administration - Users and Roles
• Labels:

  • CVE-2016-4318
  • admin-xss
  • advisory
  • advisory-released
  • affects-cloud
  • affects-server
  • cvss-medium
  • security
  • xss

[JRASERVER-61861] CVE-2016-4318: XSS vulnerability in role name on /project/ViewDefaultProjectRoleActors.jspa

Owen made changes - 16/Oct/2018 12:48 AM

Workflow	Original: JAC Bug Workflow v2 [ 2841680 ]	New: JAC Bug Workflow v3 [ 2919443 ]
Status	Original: Resolved [ 5 ]	New: Closed [ 6 ]

Owen made changes - 25/Sep/2018 12:37 AM

Workflow	Original: JIRA Bug Workflow w Kanban v7 - Restricted [ 2573493 ]	New: JAC Bug Workflow v2 [ 2841680 ]
Status	Original: Closed [ 6 ]	New: Resolved [ 5 ]

Kamil Kolonko made changes - 05/Apr/2018 11:38 AM

Fix Version/s		New: 7.1.9 [ 64205 ]
Fix Version/s	Original: 7.1.9 Server [ 62034 ]

Ignat (Inactive) made changes - 01/Feb/2018 2:16 PM

Workflow

Original: JIRA Bug Workflow w Kanban v6 - Restricted [ 1554274 ]

New: JIRA Bug Workflow w Kanban v7 - Restricted [ 2573493 ]

Ignat (Inactive) made changes - 08/Dec/2017 11:52 AM

Fix Version/s		New: Available in Cloud [ 77401 ]
Fix Version/s	Original: 1000.35.0 Cloud [ 62057 ]

jonah (Inactive) made changes - 02/Apr/2017 11:24 AM

Description

Original: A JIRA administrator(a user who is a member of the jira-administrators group) can create a persistent XSS that affects the /project/ViewDefaultProjectRoleActors.jspa resource through a role name.

New: {panel:bgColor=#e7f4fa}   *NOTE:* This bug report is for *JIRA Server*. Using *JIRA Cloud*? [See the corresponding bug report|http://jira.atlassian.com/browse/JRACLOUD-61861].   {panel} A JIRA administrator(a user who is a member of the jira-administrators group) can create a persistent XSS that affects the /project/ViewDefaultProjectRoleActors.jspa resource through a role name.

jonah (Inactive) made changes - 02/Apr/2017 11:24 AM

Link

New: This issue relates to JRACLOUD-61861 [ JRACLOUD-61861 ]

Oswaldo Hernandez (Inactive) made changes - 14/Jul/2016 8:20 AM

Component/s

New: Project Administration - Users and Roles [ 11832 ]

David Black made changes - 13/Jul/2016 5:53 AM

Description

Original: A JIRA administrator(a user who is a member of the jira-administrators group) can create a persistent XSS that affects the /project/ViewDefaultProjectRoleActors.jspa resource.

New: A JIRA administrator(a user who is a member of the jira-administrators group) can create a persistent XSS that affects the /project/ViewDefaultProjectRoleActors.jspa resource through a role name.

David Black made changes - 13/Jul/2016 5:52 AM

Security

Original: Reporter and Atlassian Staff [ 10751 ]

Load more older history items