Bug 1057699 (CVE-2013-6235)

Summary:	CVE-2013-6235 jamonapi: multiple reflected XSS vulnerabilities
Product:	[Other] Security Response	Reporter:	Martin Prpič <mprpic>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	carnil, puntogil
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-01-27 18:58:34 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1057700
Bug Blocks:

Description Martin Prpič 2014-01-24 15:54:25 UTC

Multiple non-persistent Cross-Site Scripting vulnerabilities have been identified [1] in the JAMon web application. JAMon contains a flaw that allows multiple reflected cross-site scripting (XSS) attacks. This flaw exists because certain pages do not validate input before returning it to users.

This issue is reported to affect version 2.7, and has not yet been fixed upstream.

[1] http://seclists.org/bugtraq/2014/Jan/92

Comment 1 Martin Prpič 2014-01-24 15:55:43 UTC

Created jamonapi tracking bugs for this issue:

Affects: fedora-all [bug 1057700]

Comment 2 gil cattaneo 2014-01-25 00:19:48 UTC

This issue should be of interest to only jamon.war ?
If is so then you can close this bug,
our package don't provides this artifact.

The issues should be related to these files:
exceptions.jsp
jamonadmin.jsp
mondetail.jsp
sql.jsp

availables only in the WAR file

regards

Comment 3 Vincent Danen 2014-01-27 18:58:34 UTC

Thank you, Gil.  You are correct regarding the WAR file; I just checked the jamon.jar and jamonapi.jar files and these affected files are not there.