Stored XSS in JIRA v4.4.3#663-r165197, GreenHopper
The Anonymous Researchers discovered a Stored XSS vulnerability allowing an attacker to inject arbitrary script code into an existing and fully patched JIRA + GreenHopper installations (JIRA=V4.4.3, GreenHopper prior to V5.9.8). The requirements for a successful attack are minimal. A user logged into the targeted JIRA issue tracking system needs to be convinced to visit an attacker controlled link. Once that link has been visited by the unsuspecting victim, an invisible form will perform a POST request and the victim will be redirected to a URL where username, password and login credentials such as cookies can be read and processed by the attacker. An attacker can obtain access to privileged accounts and get control over the JIRA issue tracker and connected systems.
