Uploaded image for project: 'Jira Software Data Center'
  1. Jira Software Data Center
  2. JSWSERVER-6705

XSS in redirectType parameter on SearchBoard.jspa

XMLWordPrintable

      NOTE: This bug report is for JIRA Software Server. Using JIRA Software Cloud? See the corresponding bug report.

      This is difficult to reproduce - needs tampering with the post data for the page.

      On Classic Board, go to the search box. Tamper with the posted data and add the parameter redirectURL with something like:
      redirectType=xxx"><img src=u onerror=alert(1)>
      (Note: it doesn't work if you use <script></script> tags)

      You need to have > 1 page of search results - more than 30 by default, or change the Issues Per Page in the Tools > User Preferences section.

      The image is rendered within the page numbers.

            [JSWSERVER-6705] XSS in redirectType parameter on SearchBoard.jspa

            No work has yet been logged on this issue.

              Unassigned Unassigned
              jcranford@atlassian.com JoanneA (Inactive)
              Affected customers:
              0 This affects my team
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: