NOTE: This bug report is for JIRA Software Cloud. Using JIRA Software Server? See the corresponding bug report.
This is difficult to reproduce - needs tampering with the post data for the page.
On Classic Board, go to the search box. Tamper with the posted data and add the parameter redirectURL with something like:
redirectType=xxx"><img src=u onerror=alert(1)>
(Note: it doesn't work if you use <script></script> tags)
You need to have > 1 page of search results - more than 30 by default, or change the Issues Per Page in the Tools > User Preferences section.
The image is rendered within the page numbers.
- is related to
-
JSWSERVER-6705 XSS in redirectType parameter on SearchBoard.jspa
-
- Closed
-