Details
-
Bug
-
Resolution: Fixed
-
Major
-
2.3.2, 2.4
-
None
-
security, xss, patch
-
Integration
-
Easy
-
Description
Multiple reflected & stored XSS issues all over the place.
Escaping test result:
org.xwiki.escaping.framework.EscapingError: Escaping test for XWIKI-5404 failed.
Tested file: templates/editclass.vm
URL: http://127.0.0.1:8080/xwiki/bin/edit/aaa%22bbb%27ccc%3Eddd%3Ceee/aaa%22bbb%27ccc%3Eddd%3Ceee?editor=class&language=en
List of validation errors:
line 268 column 45 FATAL: Unescaped apostrophe character
line 268 column 41 FATAL: Unescaped quote character
line 269 column 137 FATAL: Unescaped apostrophe character
line 269 column 133 FATAL: Unescaped quote character
line 283 column 22 FATAL: Unescaped apostrophe character
line 283 column 42 FATAL: Unescaped apostrophe character
line 283 column 18 FATAL: Unescaped quote character
line 283 column 38 FATAL: Unescaped quote character
line 284 column 24 FATAL: Unescaped apostrophe character
line 284 column 44 FATAL: Unescaped apostrophe character
line 284 column 96 FATAL: Unescaped apostrophe character
line 284 column 116 FATAL: Unescaped apostrophe character
line 284 column 20 FATAL: Unescaped quote character
line 284 column 40 FATAL: Unescaped quote character
line 284 column 92 FATAL: Unescaped quote character
line 284 column 112 FATAL: Unescaped quote character
line 307 column 24 FATAL: Unescaped apostrophe character
line 307 column 44 FATAL: Unescaped apostrophe character
line 307 column 20 FATAL: Unescaped quote character
line 307 column 40 FATAL: Unescaped quote character
org.xwiki.escaping.framework.EscapingError: Escaping test for page name failed.
Tested file: templates/editclass.vm
URL: http://127.0.0.1:8080/xwiki/bin/view/Main/aaa%22bbb%27ccc%3Eddd%3Ceee?skin=default&vm=editclass.vm&xpage=xpart&language=en
List of validation errors:
line 63 column 27 FATAL: Unescaped apostrophe character
line 63 column 23 FATAL: Unescaped quote character
line 64 column 29 FATAL: Unescaped apostrophe character
line 64 column 86 FATAL: Unescaped apostrophe character
line 64 column 25 FATAL: Unescaped quote character
line 64 column 82 FATAL: Unescaped quote character
line 87 column 29 FATAL: Unescaped apostrophe character
line 87 column 25 FATAL: Unescaped quote character
org.xwiki.escaping.framework.EscapingError: Escaping test for space name failed.
Tested file: templates/editclass.vm
URL: http://127.0.0.1:8080/xwiki/bin/view/aaa%22bbb%27ccc%3Eddd%3Ceee/WebHome?skin=default&vm=editclass.vm&xpage=xpart&language=en
List of validation errors:
line 63 column 22 FATAL: Unescaped apostrophe character
line 63 column 18 FATAL: Unescaped quote character
line 64 column 24 FATAL: Unescaped apostrophe character
line 64 column 84 FATAL: Unescaped apostrophe character
line 64 column 20 FATAL: Unescaped quote character
line 64 column 80 FATAL: Unescaped quote character
line 87 column 24 FATAL: Unescaped apostrophe character
line 87 column 20 FATAL: Unescaped quote character