Summary

The Plugin Reminder for Jira gives users the ability to create simple reminders for themselves and other users within the same Jira instance. It is possible to embed HTML code directly within a single reminder, leading to a Cross-Site Scripting vulnerability, that can be used to target other users. The victim user simply has to view the reminder and the attacker’s payload will be triggered within the victim’s browser.

CVE-2023-30453 was assigned for this vulnerability.

Mitigation & Recommendation

The vulnerability has been fixed in version 2.6.6, although it is not mentioned explicitly which security vulnerabilities were fixed with this patch.

It is recommended to upgrade the plugin to the latest version, which fixes this vulnerability. We tested the updated plugin to ensure this vulnerability can no longer be exploited.

We closely follow the OWASP Guidelines when performing penetration tests and we recommend following the Cross-Site Scripting Prevention Cheat Sheet to successfully mitigate Cross-Site Scripting vulnerabilities.

Disclosure Policy

At Y-Security we take security vulnerabilities seriously and follow a responsible disclosure policy. The 90-day disclosure deadline was exceeded and therefore we decided to disclosure the vulnerability after a fix had been released.

Disclosure Timeline

Author