incubator-jspwiki-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Florian Holeczek (JIRA)" <j...@apache.org>
Subject [jira] [Closed] (JSPWIKI-319) XSS Vulnerability in Change Note
Date Sat, 10 Sep 2011 23:19:08 GMT

     [ https://issues.apache.org/jira/browse/JSPWIKI-319?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Florian Holeczek closed JSPWIKI-319.
------------------------------------


> XSS Vulnerability in Change Note
> --------------------------------
>
>                 Key: JSPWIKI-319
>                 URL: https://issues.apache.org/jira/browse/JSPWIKI-319
>             Project: JSPWiki
>          Issue Type: Bug
>          Components: Core & storage
>    Affects Versions: 2.6.1
>         Environment: Windows 2000 Server, Tomcat 5.5
>            Reporter: Sufyan Muhammad
>            Assignee: Harry Metske
>            Priority: Blocker
>             Fix For: 2.6.4, 2.8
>
>         Attachments: JSPWiki-319.patch
>
>
> XSS vulnerability in change note when adding an attachment to a page. Originally noticed
in 2.6.1, also tested with 2.8.0-alpha-1.
> How to repeat: When adding an attachement to a page, enter <script>alert('XSS')</script>
in the change note then upload the file.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira

        

Mime
View raw message