[
https://issues.apache.org/jira/browse/MESOS-6947?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
haosdent updated MESOS-6947:
----------------------------
Description:
There exists an XSS vulnerability in pailer.html.
{{window.name}} can be set to an external domain serving js which is wrapped in
{{<script>}} tags by the {{getJSON}} async call. A detailed example will follow
acceptance of the patch.
was:
There exists a XSS vulnerability in pailer.html.
`window.name` can be set to an external domain serving js which is wrapped in
`<script>` tags by the `getJSON` async call. A detailed example will follow
acceptance of the patch.
> Fix pailer XSS vulnerability
> ----------------------------
>
> Key: MESOS-6947
> URL: https://issues.apache.org/jira/browse/MESOS-6947
> Project: Mesos
> Issue Type: Improvement
> Components: webui
> Reporter: Jacob Janco
> Assignee: Jacob Janco
>
> There exists an XSS vulnerability in pailer.html.
> {{window.name}} can be set to an external domain serving js which is wrapped
> in {{<script>}} tags by the {{getJSON}} async call. A detailed example will
> follow acceptance of the patch.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
