You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@jackrabbit.apache.org by "Julian Reschke (JIRA)" <ji...@apache.org> on 2016/02/26 10:24:18 UTC
[jira] [Commented] (JCR-3950) CLONE - XSS in
DirListingExportHandler
[ https://issues.apache.org/jira/browse/JCR-3950?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15168707#comment-15168707 ]
Julian Reschke commented on JCR-3950:
-------------------------------------
When generating a directory listing, the "DirListingExportHandler" places the raw name of the JCR folder into the HTML markup; thus this can be used to inject arbitrary Javascript.
Mitigation:
This vulnerability only affects systems that use Jackrabbit's WebDAV component. If this isn't in use, no immediate action is required. If WebDAV *is* used, the "DirListingExportHandler" can be disabled by removing the relevant "iohandler" element from config.xml.
> CLONE - XSS in DirListingExportHandler
> --------------------------------------
>
> Key: JCR-3950
> URL: https://issues.apache.org/jira/browse/JCR-3950
> Project: Jackrabbit Content Repository
> Issue Type: Bug
> Components: jackrabbit-jcr-server
> Affects Versions: 2.0.5, 2.2.13, 2.4.5, 2.6.5, 2.10.1, 2.8.1, 2.12.0
> Reporter: Julian Reschke
> Assignee: Julian Reschke
> Fix For: 2.12.1
>
>
> The XSS vulnerability patched in JCR-3630 applies to the parent name (and the repository metadata) as well, thus more needs to be escaped.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)