Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-11040

Grouppicker and Userpicker display unescaped user-entered content

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Medium Medium
    • 2.7.3, 2.8
    • 2.1.5, 2.2.10, 2.3.3, 2.4.5, 2.5.8, 2.6.2, 2.7.2
    • None

    • Browser: MSIE

      As reported at CONF-9559 the spaces/openuserpicker.action and spaces/grouppicker.action display unescaped content that can be entered in the url. This forms an XSS vulnerability.

        1. CONF-11040-patch-for-2.6.zip
          4 kB

            [CONFSERVER-11040] Grouppicker and Userpicker display unescaped user-entered content

            Don Willis added a comment -

            All output in the userpicker and grouppicker that can be affected by user input are now escaped correctly.

            Don Willis added a comment - All output in the userpicker and grouppicker that can be affected by user input are now escaped correctly.

            Don Willis added a comment -

            The following fields could pose XSS vulnerabilities:
            In the group picker:

            • startIndex
            • groupnameTerm
            • key
            • onPopupSubmit
            • existingGroups

            In the user picker

            • onPopupSubmit

            Don Willis added a comment - The following fields could pose XSS vulnerabilities: In the group picker: startIndex groupnameTerm key onPopupSubmit existingGroups In the user picker onPopupSubmit

            Don Willis added a comment - - edited

            The CONF-11040-patch-for-2.6.zip file contains updated files to fix this bug in Confluence 2.6.2
            There are four updated velocity template (.vm) files in the zip. To apply the patch:

            1. backup your existing confluence/spaces/permissions directory.
            2. unzip the patch into the confluence/spaces/permissions directory
            3. confirm that the confluence/spaces/permissions directory contains 7 vm files and 1 help directory.
            4. confirm that the following files have newer dates than the other files:
              • grouppicker-results.vm
              • grouppicker.vm
              • userpicker-results.vm
              • userpicker-form.vm
            5. restart Confluence.

            Don Willis added a comment - - edited The CONF-11040-patch-for-2.6.zip file contains updated files to fix this bug in Confluence 2.6.2 There are four updated velocity template (.vm) files in the zip. To apply the patch: backup your existing confluence/spaces/permissions directory. unzip the patch into the confluence/spaces/permissions directory confirm that the confluence/spaces/permissions directory contains 7 vm files and 1 help directory. confirm that the following files have newer dates than the other files: grouppicker-results.vm grouppicker.vm userpicker-results.vm userpicker-form.vm restart Confluence.

              dave@atlassian.com dave (Inactive)
              don.willis@atlassian.com Don Willis
              Affected customers:
              0 This affects my team
              Watchers:
              0 Start watching this issue

                Created:
                Updated:
                Resolved: