Uploaded image for project: 'Jira Software Data Center'
  1. Jira Software Data Center
  2. JSWSERVER-5676

GH Webwork actions are vulnerable to XSRF.

    XMLWordPrintable

Details

    • We collect Jira feedback from various sources, and we evaluate what we've collected when planning our product roadmap. To understand how this piece of feedback will be reviewed, see our Implementation of New Features Policy.

    Description

      GHCreateNewIssue.jspa is not protected against XSRF attacks.
      Impact: It is possible for an attacker to make a victim create new issues on the victim's JIRA instance through this bug in GHCreateNewIssue.jspa.

      Attachments

        Issue Links

          details

          Bug - A problem which impairs or prevents the functions of the product. JSWSERVER-5777 Add XSRF protection to LicenseAction

          • Low - Low priority issues
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. JSWSERVER-5778 Add XSRF protection to ConfigurationAction and subclasses (Global and Project) for all page pop methods

          • Low - Low priority issues
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. JSWSERVER-5779 Add XSRF protection to SetIssueDisplay on CardBoardAction

          • Low - Low priority issues
          • Closed
          has a derivative of

          Bug - A problem which impairs or prevents the functions of the product. JSWSERVER-6355 XSRF in com.pyxis.greenhopper.jira.actions.VersionBoardAction

          • High - High priority issues
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. JSWSERVER-6356 XSRF com.pyxis.greenhopper.jira.actions.TaskBoardAction

          • High - High priority issues
          • Closed

          Activity

            People

              mtokar Michael Tokar
              dblack David Black
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: