Bug 793514 (JBEPP-595) - XSS issue in category name input
Summary: XSS issue in category name input
Keywords:
Status: CLOSED NEXTRELEASE
Alias: JBEPP-595
Product: JBoss Enterprise Portal Platform 5
Classification: JBoss
Component: unspecified
Version: 5.1.0.ER03
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 5.1.0.ER04,5.2.0.DEV03
Assignee: hfnukal@redhat.com
QA Contact:
URL: http://jira.jboss.org/jira/browse/JBE...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-10-29 14:47 UTC by Viliam Rockai
Modified: 2015-09-01 03:31 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-08-18 23:01:35 UTC
Type: Bug

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker JBEPP-595 0 Major Closed XSS issue in category name input 2012-08-23 07:14:24 UTC

Description Viliam Rockai 2010-10-29 14:47:00 UTC 
project_key: JBEPP

- go to app registry
- create new category with name "whatever" and display name and description with text:
<script>alert('hi');</script>
- add some portlet to this category
- go to home page, click edit page
- the script is invoked
Comment 1 Viliam Rockai 2010-10-29 14:47:14 UTC 
Security: Removed: Public Added: RHT+eXo
Comment 2 Thomas Heute 2010-11-02 10:18:34 UTC 
Link: Added: This issue is related to GTNPORTAL-1618
Comment 3 Thomas Heute 2010-11-12 08:42:40 UTC 
Tentatively set for 5.1.0 CR01
Comment 5 hfnukal@redhat.com 2011-09-07 16:19:07 UTC 
Security: Removed: RHT+eXo Added: Public
Note You need to log in before you can comment on or make changes to this bug.