Lucene search

K
atlassianHailpervATLASSIAN:CONFSERVER-53243
HistoryAug 17, 2017 - 6:08 a.m.

XSS in User Macros Description Field

2017-08-1706:08:01
hailperv
jira.atlassian.com
19

EPSS

0.001

Percentile

28.6%

We received external report about XSS in User Macros Field:
{quote}
The description field in User Macros is vulnerable to persistent XSS. The XSS will be executed when the user chooses the macro from the macro selector.
{quote}
Steps to reproduce:

  1. Go to http://localhost:8090/admin/usermacros.action
  2. Add user macro with description “><script>alert(2)</script>”
  3. Try to add this macro on the page. It should trigger xss

EPSS

0.001

Percentile

28.6%

Related for ATLASSIAN:CONFSERVER-53243