[jboss-jira] [JBoss JIRA] Updated: (JBAS-5855) Moderate: Cross-Site-Scripting in JMX console

Moderate: Cross-Site-Scripting in JMX console --------------------------------------------- Key: JBAS-5855 URL: https://jira.jboss.org/jira/browse/JBAS-5855 Project: JBoss Application Server Issue Type: Bug Security Level: Public(Everyone can see) Affects Versions: JBossAS-5.0.0.CR1, JBossAS-4.2.3.GA Reporter: Clive Saldanha Assignee: Clive Saldanha Fix For: JBossAS-5.0.0.CR2, JBossAS-4.2.4.GA Attachments: JBAS-5855_Branch_4_2.patch, JBAS-5855_trunk.patch Quoting Marc Schoenefeld from JBPAPP issue "Enter aa"<script>alert(document.cookie)</script>:* into http://127.0.0.1:8080/jmx-console/HtmlAdaptor?action=displayMBeans it will show that arbitrary web script can be inserted"