Announcement Preview banner is a vector for an XSS attack

XMLWordPrintable

    • 3.12

      The announcement preview banner is currently displayed via the global decorator. It can be used for an XSS attack on virtually every page, via the announcement_preview_banner_st URL parameter. We should display the preview only locally in the admin section.

              Assignee:
              Unassigned
              Reporter:
              Andreas Knecht (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: