From jira-events at lists.jboss.org Wed Oct  3 04:52:05 2012
Content-Type: multipart/mixed; boundary="===============3533679024247932058=="
MIME-Version: 1.0
From: Trong Tran (JIRA) <jira-events at lists.jboss.org>
To: gatein-issues at lists.jboss.org
Subject: [gatein-issues] [JBoss JIRA] (GTNPORTAL-2578) XSS in page title of
 container
Date: Wed, 03 Oct 2012 04:52:04 -0400
Message-ID: <269674486.13193.1349254324674.JavaMail.tomcat@jira02.app.mwc.hst.phx2.redhat.com>
In-Reply-To: 736337466.8023.1348023754780.JavaMail.tomcat@jira02.app.mwc.hst.phx2.redhat.com

--===============3533679024247932058==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable


     [ https://issues.jboss.org/browse/GTNPORTAL-2578?page=3Dcom.atlassian.=
jira.plugin.system.issuetabpanels:all-tabpanel ]

Trong Tran updated GTNPORTAL-2578:
----------------------------------

    Labels: portal-s69  (was: )

    =

> XSS in page title of container
> ------------------------------
>
>                 Key: GTNPORTAL-2578
>                 URL: https://issues.jboss.org/browse/GTNPORTAL-2578
>             Project: GateIn Portal
>          Issue Type: Bug
>      Security Level: Public(Everyone can see) =

>          Components: Security
>    Affects Versions: 3.4.0.Final
>            Reporter: Trong Tran
>            Assignee: Trong Tran
>              Labels: portal-s69
>             Fix For: 3.5.0.Beta01
>
>
> Add/Edit a page
>     Choose container tab
>     Drag & drop container ( one row)
>     Change title of container by: </title><script>alert("xssed portal")</=
script>
>     Click Save
>     =3D> it alerts "xssed portal" message

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrato=
rs
For more information on JIRA, see: http://www.atlassian.com/software/jira

--===============3533679024247932058==--