Bug 1057699 (CVE-2013-6235) - CVE-2013-6235 jamonapi: multiple reflected XSS vulnerabilities
Summary: CVE-2013-6235 jamonapi: multiple reflected XSS vulnerabilities
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2013-6235
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1057700
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-01-24 15:54 UTC by Martin Prpič
Modified: 2019-09-29 13:13 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2014-01-27 18:58:34 UTC
Embargoed:

Attachments (Terms of Use)

Description Martin Prpič 2014-01-24 15:54:25 UTC 
Multiple non-persistent Cross-Site Scripting vulnerabilities have been identified [1] in the JAMon web application. JAMon contains a flaw that allows multiple reflected cross-site scripting (XSS) attacks. This flaw exists because certain pages do not validate input before returning it to users.

This issue is reported to affect version 2.7, and has not yet been fixed upstream.

[1] http://seclists.org/bugtraq/2014/Jan/92
Comment 1 Martin Prpič 2014-01-24 15:55:43 UTC 
Created jamonapi tracking bugs for this issue:

Affects: fedora-all [bug 1057700]
Comment 2 gil cattaneo 2014-01-25 00:19:48 UTC 
This issue should be of interest to only jamon.war ?
If is so then you can close this bug,
our package don't provides this artifact.

The issues should be related to these files:
exceptions.jsp
jamonadmin.jsp
mondetail.jsp
sql.jsp

availables only in the WAR file

regards
Comment 3 Vincent Danen 2014-01-27 18:58:34 UTC 
Thank you, Gil.  You are correct regarding the WAR file; I just checked the jamon.jar and jamonapi.jar files and these affected files are not there.
Note You need to log in before you can comment on or make changes to this bug.