From jira-events at lists.jboss.org Fri Oct 12 02:54:03 2012
Content-Type: multipart/mixed; boundary="===============6338762022147770768=="
MIME-Version: 1.0
From: Vu Viet Phuong (JIRA) <jira-events at lists.jboss.org>
To: gatein-issues at lists.jboss.org
Subject: [gatein-issues] [JBoss JIRA] (GTNPORTAL-2578) XSS in page title of
 container
Date: Fri, 12 Oct 2012 02:54:03 -0400
Message-ID: <1908582443.37103.1350024843704.JavaMail.tomcat@jira02.app.mwc.hst.phx2.redhat.com>
In-Reply-To: 736337466.8023.1348023754780.JavaMail.tomcat@jira02.app.mwc.hst.phx2.redhat.com

--===============6338762022147770768==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable


     [ https://issues.jboss.org/browse/GTNPORTAL-2578?page=3Dcom.atlassian.=
jira.plugin.system.issuetabpanels:all-tabpanel ]

Vu Viet Phuong updated GTNPORTAL-2578:
--------------------------------------

              Status: Pull Request Sent  (was: Coding In Progress)
    Git Pull Request: https://github.com/gatein/gatein-portal/pull/209

    =

> XSS in page title of container
> ------------------------------
>
>                 Key: GTNPORTAL-2578
>                 URL: https://issues.jboss.org/browse/GTNPORTAL-2578
>             Project: GateIn Portal
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) =

>          Components: Security
>    Affects Versions: 3.4.0.Final
>            Reporter: Trong Tran
>            Assignee: Vu Viet Phuong
>              Labels: portal-s69
>             Fix For: 3.5.0.Beta01
>
>
> Add/Edit a page
>     Choose container tab
>     Drag & drop container ( one row)
>     Change title of container by: </title><script>alert("xssed portal")</=
script>
>     Click Save
>     =3D> it alerts "xssed portal" message

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrato=
rs
For more information on JIRA, see: http://www.atlassian.com/software/jira

--===============6338762022147770768==--