Details
-
Bug
-
Status: Closed
-
Major
-
Resolution: Done
-
R3.5.3
Description
There are (at least) two XSS vulnerabilities (JS code injection) into the HTML code of the Test Run page.
This was reproduced in Jira 7.13.1 (however, any version should do it) and Xray 3.5.3.
Steps to reproduce (Generic field entry point):
- Create a new Generic Test issue
- In the Generic Test Definition field write: <script>alert("XSS")</script>
- Create a new Test Run: “Execute In” -> “New Test Execution”
- Open the Test Run page -> You will see the alert in the page
Steps to reproduce (Pre-Condition Summary entry point):
- Create a new Test
- In the Test Issue click on "Create Pre-Condition"
- In the summary field write: <script>alert("XSS PreCond")</script>
- Create a new Test Run: “Execute In” -> “New Test Execution”
- Open the Test Run page -> You will see the alert in the page
Attachments
Issue Links
- implements
-
XRAY-3909 JS is being injected in the Test Repository page
- Closed