You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@jspwiki.apache.org by "Juan Pablo Santos RodrÃguez (JIRA)" <ji...@apache.org> on 2019/03/26 21:52:00 UTC
[jira] [Closed] (JSPWIKI-1093) Reflected XSS in JSPWiki v2.11.0-M1
[ https://issues.apache.org/jira/browse/JSPWIKI-1093?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Juan Pablo Santos RodrÃguez closed JSPWIKI-1093.
------------------------------------------------
> Reflected XSS in JSPWiki v2.11.0-M1
> -----------------------------------
>
> Key: JSPWIKI-1093
> URL: https://issues.apache.org/jira/browse/JSPWIKI-1093
> Project: JSPWiki
> Issue Type: Bug
> Components: Templates and UI
> Affects Versions: 2.10.3, 2.10.4, 2.10.5, 2.11.0-M1, 2.11.0-M2
> Reporter: brushed
> Assignee: brushed
> Priority: Critical
> Fix For: 2.11.0-M3
>
>
> ---------- Forwarded message ---------
> From: Muthukumar Marikani <[muthukumar.marikani@zohocorp.com|mailto:muthukumar.marikani@zohocorp.com]>
> Date: Fri, Mar 15, 2019 at 1:14 PM
> Subject: Reflected XSS in JSPWiki v2.11.0-M1
> To: security <[security@apache.org|mailto:security@apache.org]>
> Hi,
> I have found a reflected XSS vulnerability in JSPWiki v2.11.0-M1
> [snip]
> An attacker can execute javascript in victim's browser by sending crafted url to victim
> Recommended fix :
> Encode the values which are from user end
> Product : JSPWiki
> Version : v2.11.0-M1
> Verified in : firefox 65.0.1 , MacOS 10.12.6
> Severity : Medium
> Regards,
> Muthukumar Marikani (unknown_person)
> ZOHO-CRM Security Team
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)