Atlassian JIRA Cross Site Scripting and HTML Injection Vulnerabilities

Bugtraq ID:	31967
Class:	Input Validation Error
CVE:	CVE-2008-6832 CVE-2008-6831
Remote:	Yes
Local:	No
Published:	Oct 28 2008 12:00AM
Updated:	Jul 05 2016 10:01PM
Credit:	Thomas Pollet
Vulnerable:	Atlassian JIRA 3.13
Not Vulnerable:	Atlassian JIRA 3.13.1

Atlassian JIRA Cross Site Scripting and HTML Injection Vulnerabilities

Atlassian JIRA is prone to a HTML-injection issue and a cross-site scripting issue.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or control how the site is rendered to the user. Other attacks are also possible.

Atlassian JIRA 3.13 is vulnerable; other versions may also be affected.

Atlassian JIRA Cross Site Scripting and HTML Injection Vulnerabilities

An attacker can exploit these issues through a browser. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting victim into following a malicious URI.

Atlassian JIRA Cross Site Scripting and HTML Injection Vulnerabilities

Solution:
The vendor has released patches and updates. Please see the references for more information.

Atlassian JIRA Cross Site Scripting and HTML Injection Vulnerabilities

References:

• Atlassian JIRA Web Site (Atlassian)
  
• JIRA Security Advisory 2008-10-29 (Atlassian)