[#CONF-8980] XSS vulnerability at "Edit Space Permissions"

Confluence

Created: 23/Jul/07 06:52 AM Updated: 07/Aug/07 08:46 PM

Component/s:

Security

Affects Version/s:

2.5.4

Fix Version/s:

2.5.6, 2.6.0

Time Tracking:

Not Specified

Environment:

Standalone

Participants:	Gergely Hodicska and Samuel Le Berrigaud [Atlassian]
Since last comment:	1 year, 11 weeks, 4 days ago
Resolution Date:	24/Jul/07 03:02 AM
Labels:

Description

« Hide

Description:
XSS vulnerability at "Edit Space Permissions" page

Exploit:
Write to the "Grant permission to" field: "<script>alert(document.cookie)</script>"

All

Comments

Work Log

Change History

Sort Order:

[ Permlink | « Hide ]

Encoded user and group names in error message.