Atlassian JIRA Unspecified URI Redirection Vulnerability

Bugtraq ID:	46461
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 21 2011 12:00AM
Updated:	Feb 21 2011 12:00AM
Credit:	Reported by the vendor.
Vulnerable:	Atlassian JIRA 4.2.1 Atlassian JIRA 4.1.2 Atlassian JIRA 4.1.1 Atlassian JIRA 4.0.2 Atlassian JIRA 4.0.1 Atlassian JIRA 4.1 Atlassian JIRA 4.0
Not Vulnerable:	Atlassian JIRA 4.2.2

Atlassian JIRA Unspecified URI Redirection Vulnerability

Atlassian JIRA is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are also possible.

Versions prior to Atlassian JIRA 4.2.2 are vulnerable.

Atlassian JIRA Unspecified URI Redirection Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Atlassian JIRA Unspecified URI Redirection Vulnerability

Solution:
Updates are available. Please see the references for more information.

Atlassian JIRA Unspecified URI Redirection Vulnerability

References:

• Atlassian JIRA Homepage (Atlassian)
  
• JIRA Security Advisory 2011-02-21 (Atlassian)