NOTE: This bug report is for JIRA Software Cloud. Using JIRA Software Server? See the corresponding bug report.
This is difficult to reproduce - needs tampering with the post data for the page.
On Classic Board, go to the search box. Tamper with the posted data and add the parameter redirectURL with something like:
redirectType=xxx"><img src=u onerror=alert(1)>
(Note: it doesn't work if you use <script></script> tags)
You need to have > 1 page of search results - more than 30 by default, or change the Issues Per Page in the Tools > User Preferences section.
The image is rendered within the page numbers.
- is related to
-
JSWSERVER-6705 XSS in redirectType parameter on SearchBoard.jspa
-
- Closed
-
[JSWCLOUD-6705] XSS in redirectType parameter on SearchBoard.jspa
| Workflow | Original: JSWCLOUD Bug Workflow [ 3193393 ] | New: JAC Bug Workflow v3 [ 3471370 ] |
| Status | Original: Resolved [ 5 ] | New: Closed [ 6 ] |
| Workflow | Original: JIRA Bug Workflow w Kanban v6 - Restricted [ 1887650 ] | New: JSWCLOUD Bug Workflow [ 3193393 ] |
| Description |
Original:
This is difficult to reproduce - needs tampering with the post data for the page. On Classic Board, go to the search box. Tamper with the posted data and add the parameter redirectURL with something like: redirectType=xxx"><img src=u onerror=alert(1)> (Note: it doesn't work if you use <script></script> tags) You need to have > 1 page of search results - more than 30 by default, or change the Issues Per Page in the Tools > User Preferences section. The image is rendered within the page numbers. |
New:
{panel:bgColor=#e7f4fa} *NOTE:* This bug report is for *JIRA Software Cloud*. Using *JIRA Software Server*? [See the corresponding bug report|http://jira.atlassian.com/browse/JSWSERVER-6705]. {panel} This is difficult to reproduce - needs tampering with the post data for the page. On Classic Board, go to the search box. Tamper with the posted data and add the parameter redirectURL with something like: redirectType=xxx"><img src=u onerror=alert(1)> (Note: it doesn't work if you use <script></script> tags) You need to have > 1 page of search results - more than 30 by default, or change the Issues Per Page in the Tools > User Preferences section. The image is rendered within the page numbers. |
| Link |
New:
This issue is related to |
| Project Import | New: Sun Apr 02 01:01:23 UTC 2017 [ 1491094883663 ] |
| Workflow | Original: JIRA Bug Workflow w Kanban v6 [ 909301 ] | New: JIRA Bug Workflow w Kanban v6 - Restricted [ 1551745 ] |
| Labels | Original: security | New: cvss-high security |
| Workflow | Original: GreenHopper Kanban Workflow 20141014 [ 745843 ] | New: JIRA Bug Workflow w Kanban v6 [ 909301 ] |
| Workflow | Original: GreenHopper Kanban Workflow v2 [ 449341 ] | New: GreenHopper Kanban Workflow 20141014 [ 745843 ] |
| Labels | Original: advisory-pending security | New: security |
| Security | Original: Reporters and Developers [ 10021 ] |