[CONFSERVER-9456] XSS Bug in printable link display - Create and track feature requests for Atlassian products.

XML

Word

Printable

Details

Type: Bug
Status: Closed (View Workflow)
Priority: High
Resolution: Fixed
Affects Version/s: 2.5.7
Fix Version/s: 2.6.1
Component/s: None
Labels:
- affects-server
- security
Environment:

Solaris 10, JDK 1.5.0_12, SunOne WebServer 6.1 SP8

Bug Fix Policy:
View Atlassian Server bug fix policy

Description

A Cross sites scripting vulnerability exists in macro used to render the 'printable' link.

Here is an exploit for the vulnerability that works

https://servername/wiki/display/a/2007/09/%22%3E%3Cscript%3Ealert('Watchfire%20XSS%20Test%20Successful')%3C/script%3E

Bug was found using APPScan.

Attachments

Options
- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List

Attachments

wiki.appscan.doc
118 kB
13/Sep/2007 8:15 AM
printable-icon-xss.patch
1 kB
08/Oct/2007 6:13 AM
appscan.wiki.doc
361 kB
14/Sep/2007 2:49 PM

Activity

People

Assignee:: m@

Reporter:: Wyatt Crossin

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Dates

Created:: 13/Sep/2007 8:15 AM

Updated:: 11/Oct/2018 8:59 AM

Resolved:: 08/Oct/2007 6:14 AM

Time Tracking

Estimated:

2h

Remaining:

2h

Logged:

Not Specified