From jira-events at lists.jboss.org Mon Sep 12 06:23:26 2011
Content-Type: multipart/mixed; boundary="===============0250290547746543645=="
MIME-Version: 1.0
From: Khoi Nguyen (JIRA) <jira-events at lists.jboss.org>
To: gatein-issues at lists.jboss.org
Subject: [gatein-issues] [JBoss JIRA] Created: (GTNPORTAL-2090) XSS issue in
 application select permission editor
Date: Mon, 12 Sep 2011 06:23:26 -0400
Message-ID: <956177706.38645.1315823006186.JavaMail.tomcat@jira02.app.mwc.hst.phx2.redhat.com>

--===============0250290547746543645==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

XSS issue in application select permission editor
-------------------------------------------------

                 Key: GTNPORTAL-2090
                 URL: https://issues.jboss.org/browse/GTNPORTAL-2090
             Project: GateIn Portal
          Issue Type: Bug
      Security Level: Public (Everyone can see)
            Reporter: Khoi Nguyen


1/ Create new group with label is <script>alert(1)</script>
2/ Go to application, an alert appear =


The problem is that the script in group label is executed in permission sel=
ector window

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira

       =20

--===============0250290547746543645==--