You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@lucene.apache.org by "Adam Johnson (JIRA)" <ji...@apache.org> on 2015/11/17 23:54:10 UTC

[jira] [Created] (SOLR-8308) XSS vulnerability

Adam Johnson created SOLR-8308:
----------------------------------

             Summary: XSS vulnerability
                 Key: SOLR-8308
                 URL: https://issues.apache.org/jira/browse/SOLR-8308
             Project: Solr
          Issue Type: Bug
            Reporter: Adam Johnson


You can rename a core using the following modified URL https://SOLR:PORT/solr/admin/cores?wt=json&indexInfo=false&action=RENAME&core=test_app_shared2_replica2&other=%3Csvg+onload%3Dalert(1)%3E&_=1445468005152. The core becomes inaccessible / unusable.  There should be more form validation to the core name assignment



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
For additional commands, e-mail: dev-help@lucene.apache.org