Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-23244

Reflected XSS via xredirect parameter in DeleteApplication

    XMLWordPrintable

Details

    • Unknown
    • N/A
    • N/A

    Description

       

      Requires you to click "No"

       

      https://xwiki.local.test/bin/view/AppWithinMinutes/DeleteApplication?appName=Help.Applications.Contributors&resolve=true&xredirect=%2fbin%2fview%2fHelp%2fApplications%2fContributors%2f'%3balert(1)%2f%2f

       

      Looks like there was an attempt to fix this in an earlier version.

       

      The alert box disappears as the page redirects, but still can be seen in the attached video

      Attachments

        Issue Links

          is related to

          Bug - A problem which impairs or prevents the functions of the product. XWIKI-20614 RXSS via xredirect paramer in DeleteApplication

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed
          links to

          Web Link Security Advisory

          Activity

            People

              MichaelHamann Michael Hamann
              4rdr Alec
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: