Documentation for GreenHopper 6.1.x. Documentation for other versions of JIRA Agile is available too.
GreenHopper is now called JIRA Agile. Learn more.
In this advisory:
Atlassian rates these vulnerabilities as high, according to the scale published in Severity Levels for Security Issues. The scale allows us to rank a vulnerability as critical, high, moderate or low.
We have identified and fixed several cross-site scripting (XSS) vulnerabilities in GreenHopper, which may affect JIRA instances that are running the GreenHopper plugin. These vulnerabilities have security implications and are especially important for anyone running publicly accessible instances of JIRA/GreenHopper.
You can read more about XSS attacks at cgisecurity, CERT and other places on the web.
All versions of GreenHopper are affected by these XSS vulnerabilities.
An attacker can inject their own JavaScript into the following GreenHopper pages:
We strongly recommend upgrading your GreenHopper plugin to fix these vulnerabilities. Please see the 'Fix' section below.
These issues have been fixed in:
Atlassian rates this vulnerability as moderate, according to the scale published in Severity Levels for Security Issues. The scale allows us to rank a vulnerability as critical, high, moderate or low.
We have identified and fixed a vulnerability in GreenHopper, which may affect JIRA instances that are running the GreenHopper plugin. The vulnerability allows the list of Projects and Versions to be viewed by users who are not logged in to JIRA/GreenHopper.
All versions of GreenHopper are affected by this visibility vulnerability.
A user who is not logged in to JIRA/GreenHopper can see project names and version names in the drop-down lists on the GreenHopper 'Planning Board', 'Task Board', 'Release Board' or 'Charts Board'.
We strongly recommend upgrading your GreenHopper plugin to fix this vulnerability. Please see the 'Fix' section below.
These issues have been fixed in: