Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-21095

RXSS through revision parameter in content menu

    XMLWordPrintable

Details

    • Unknown
    • N/A
    • N/A

    Description

      Steps to reproduce:

      Open <xwiki-host>/xwiki/bin/view/Main/?rev=xar%3Aorg.xwiki.platform%3Axwiki-platform-distribution-flavor-common%2F15.5%25%25%22%3e%3cscript%3ealert(1)%3c%2fscript%3e where <xwiki-host> is the URL of your XWiki installation.

      Expected result:

      No alert is displayed.

      Actual result:

      An alert with content 1 is displayed.

      This is due to the revision parameter being unescaped in the source viewer menu item, introduced as part of XWIKI-14576.

      Attachments

        Issue Links

          is caused by

          Improvement - An improvement or enhancement to an existing feature or task. XWIKI-14576 Show version information and more actions options when viewing a document version

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed
          links to

          Web Link Security Advisory

          Activity

            People

              MichaelHamann Michael Hamann
              MichaelHamann Michael Hamann
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: