[
https://issues.apache.org/jira/browse/JSPWIKI-319?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Florian Holeczek closed JSPWIKI-319.
------------------------------------
> XSS Vulnerability in Change Note
> --------------------------------
>
> Key: JSPWIKI-319
> URL: https://issues.apache.org/jira/browse/JSPWIKI-319
> Project: JSPWiki
> Issue Type: Bug
> Components: Core & storage
> Affects Versions: 2.6.1
> Environment: Windows 2000 Server, Tomcat 5.5
> Reporter: Sufyan Muhammad
> Assignee: Harry Metske
> Priority: Blocker
> Fix For: 2.6.4, 2.8
>
> Attachments: JSPWiki-319.patch
>
>
> XSS vulnerability in change note when adding an attachment to a page.
> Originally noticed in 2.6.1, also tested with 2.8.0-alpha-1.
> How to repeat: When adding an attachement to a page, enter
> <script>alert('XSS')</script> in the change note then upload the file.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
