[JRASERVER-67108] XSS in various types of nested wiki markup - CVE-2017-18102 - Create and track feature requests for Atlassian products.

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Medium
Resolution: Fixed
Affects Version/s: 7.5.3
Fix Version/s: 7.7.1, 7.8.0, 7.6.8
Component/s: Issue - Fields
Labels:

Fixed in Long Term Support Release/s:

Download 7.6
Introduced in Version:
7.05
Symptom Severity:
Severity 2 - Major
Bug Fix Policy:
View Atlassian Server bug fix policy

Description

The bundled version of atlassian-renderer in Atlassian JIRA before version 7.7.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in nested wiki markup. For more information see https://jira.atlassian.com/browse/RNDR-153 (currently restricted to Atlassian staff).

Attachments

Issue Links

is related to

CRUC-8162 XSS via wiki markup

Closed

FE-6995 XSS via wiki markup

Closed

mentioned in: Page Loading...

Activity

People

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 10/Apr/2018 3:55 AM

Updated:: 22/May/2020 8:22 AM

Resolved:: 10/Apr/2018 3:55 AM