Some of the REST resources in Navigator plugin are susceptible to XSRF attacks

XMLWordPrintable

    • 6
    • 5

      Most of the REST resources in the Navigator plugin accept "x-www-form-urlencoded" bodies but do not check for an XSRF token when making mutative changes. For example:

      • SaveFilterResource: Allow XSRF attack to change user's filter.
      • SuppressedTipsResource
      • UserSearchModeResource
      • PreferredSearchLayoutResource
      • IssueTableResource: Allow XSRF attack to change the user's current search.
        *...

              Assignee:
              Eric Dalgliesh
              Reporter:
              bain
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: