Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-5552

Reflective XSS in viewtoolbar.vm

    XMLWordPrintable

Details

    • security, xss
    • Integration
    • Trivial

    Description

      Escaping test result:

      org.xwiki.escaping.framework.EscapingError: Escaping test for page name failed.
        Tested file: templates/viewtoolbar.vm
        URL: http://127.0.0.1:8080/xwiki/bin/view/Main/aaa%22bbb%27ccc%3Eddd%3Ceee?skin=default&vm=viewtoolbar.vm&xpage=xpart&language=en
        List of validation errors:
          line   18  column  71  ERROR: Unescaped < character
          line   18  column  67  ERROR: Unescaped > character
          line   22  column  94  ERROR: Unescaped < character
          line   22  column  90  ERROR: Unescaped > character
      
      org.xwiki.escaping.framework.EscapingError: Escaping test for space name failed.
        Tested file: templates/viewtoolbar.vm
        URL: http://127.0.0.1:8080/xwiki/bin/view/aaa%22bbb%27ccc%3Eddd%3Ceee/WebHome?skin=default&vm=viewtoolbar.vm&xpage=xpart&language=en
        List of validation errors:
          line   14  column  71  ERROR: Unescaped < character
          line   14  column  67  ERROR: Unescaped > character
          line   22  column  94  ERROR: Unescaped < character
          line   22  column  90  ERROR: Unescaped > character
      

      Attachments

        Activity

          People

            nickless Alex Busenius
            nickless Alex Busenius
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: