Bug 1221502

Summary:	pki-core: cross-site scripting flaw in the dogtag administration page (port 9180, port 9444)
Product:	[Other] Security Response	Reporter:	Martin Prpič <mprpic>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	alee, edewata, kwright, mharmsen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-05-15 08:32:07 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Martin Prpič 2015-05-14 08:24:14 UTC

It was reported (in bug 1220423) that the administation page of the dogtag PKI is vulnerable to reflected Cross-Site Scripting (XSS) attacks.

Upstream bug:

https://fedorahosted.org/pki/ticket/1373

Reproducer:

1. Browse to: https://ipa_server:9444/ca/ee/ca/profileSelect?profileId=plop%3C/script%3E%3Cscript%3Evar%20x=document.cookie;alert%28x%29;//

Comment 1 Martin Prpič 2015-05-14 08:25:07 UTC

Fedora tracking bug: bug 1220423

Comment 4 Martin Prpič 2015-05-15 08:32:07 UTC


*** This bug has been marked as a duplicate of bug 826646 ***