Skip to main content
Skip table of contents

2021 01 13 - P3 Security issue (XSS)

A security vulnerability was recently identified and fixed in Elements Connect. Here are the details about the issue, its impact and the analysis and actions taken.

Nature of the issue

The vulnerability was present since the first public version of Elements Connect for Jira Cloud.
The vulnerability meant that a JSM agent could forge a request to inject runnable JavaScript in Connected items values that would then execute in the browser on the next display of the ticket.
This vulnerability has been rated as medium, according to the scale published on the Common Vulnerability Scoring System (CVSS).
The vulnerability was brought to our notice by the Bug Bounty Program on  .


Based on our investigations, the vulnerability has not been exploited.

Analysis and actions taken

Once we became aware of the issue, we first confirmed that we could reproduce it. A plan was then elaborated by the IT team to analyse the situation, bring a fix for the issue and deploy it as quickly as possible.
Our investigations revealed that the problem was caused by a too broad acceptance of HTML language options in the Connected items values.

We added stricter sanitization of Connected item values to prevent a wide range of XSS attacks.

Deployment of the fixed version was conducted by following the usual CI procedure on  .
On top of the automatic tests, we made another series of tests to ensure that the problem was fixed in production.


We want you to know that we take this issue very seriously. We are conducting a thorough review of our internal processes to ensure this does not occur again for our customers.
If you have any questions, please feel free to raise a support request at referencing "ECC-881".

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.