Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-66624

XSS through the orderby parameter in the issue search resource - CVE-2017-16864

XMLWordPrintable

      The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the orderby parameter.

            [JRASERVER-66624] XSS through the orderby parameter in the issue search resource - CVE-2017-16864

            Bugfix Automation Bot made changes -
            Minimum Version New: 7.01
            Owen made changes -
            Workflow Original: JAC Bug Workflow v2 [ 2842203 ] New: JAC Bug Workflow v3 [ 2917618 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Symptom Severity Original: Major [ 14431 ] New: Severity 2 - Major [ 15831 ]
            Owen made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v7 - Restricted [ 2591642 ] New: JAC Bug Workflow v2 [ 2842203 ]
            Status Original: Closed [ 6 ] New: Resolved [ 5 ]
            Ignat (Inactive) made changes -
            Labels Original: advisory advisory-released cvss-medium dxss security xss New: advisory advisory-released cvss-medium dxss raid security xss
            Ignat (Inactive) made changes -
            Workflow Original: JIRA Bug Workflow w Kanban v6 - Restricted [ 2506141 ] New: JIRA Bug Workflow w Kanban v7 - Restricted [ 2591642 ]
            David Black made changes -
            Remote Link Original: This issue links to "Page (Extranet)" [ 345258 ]
            David Black made changes -
            Labels Original: advisory advisory-to-release cvss-medium dxss security xss New: advisory advisory-released cvss-medium dxss security xss
            David Black made changes -
            Description Original: The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the orderby parameter.. New: The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the orderby parameter.
            David Black made changes -
            Remote Link New: This issue links to "Page (Extranet)" [ 345258 ]

              Unassigned Unassigned
              security-metrics-bot Security Metrics Bot
              Affected customers:
              0 This affects my team
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: