Details
-
Bug
-
Resolution: Fixed
-
Medium
-
2.7
Description
Currently, the confluence picker does not sanitize the input ( <crowd-url>/crowd/console/secure/pickers/displayPicker.action).
Proof of concept.
- Access the following URL in your browser with javascript enabled. Replace the <crowd-url> with your crowd URL.
<crowd-url>/crowd/console/secure/pickers/displayPicker.action?searchURL=%3E%22%27%3E%3Cscript%3Ealert%2899%29%3C%2Fscript%3E&actionURL=%3E%22%27%3E%3Cscript%3Ealert%2899%29%3C%2Fscript%3E&actionName=%3E%22%27%3E%3Cscript%3Ealert%2899%29%3C%2Fscript%3E&initialMessage=%3E%22%27%3E%3Cscript%3Ealert%2899%29%3C%2Fscript%3E&finalURL=%3E%22%27%3E%3Cscript%3Ealert%2899%29%3C%2Fscript%3E
- You will see the following alert:
Attachments
Issue Links
- relates to
-
CWDSUP-8689 Loading...