WebCalendar / Bugs / #2660 Location variable injection

#2660 Location variable injection

Status: pending

Owner: Craig Knudsen

Labels: Security (98)

Priority: 5

Updated: 2012-02-20

Created: 2012-01-12

Creator: G13

Private: No

The location variable is vulnerable to XSS. Simply add <script>alert(100);</script> to text box and create the event

Discussion

Henri Salo - 2012-01-23

When do you plan to fix this? This has been openly announced already: http://seclists.org/bugtraq/2012/Jan/128

I can help to create the patch if needed. As this is stored cross site scripting security vulnerability you should fix this as soon as possible. I haven't tested this.

Information about XSS: https://www.owasp.org/index.php/Cross-site_Scripting_\(XSS)

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Henri Salo - 2012-02-12

Verified this issue in demo-page and in 1.2.4 installation.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Patrick Monnerat - 2012-02-17

Please find a proposed patch at https://sourceforge.net/tracker/?func=detail&aid=3488543&group_id=3870&atid=303870

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Craig Knudsen - 2012-02-20

status: open --> pending
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Craig Knudsen - 2012-02-20

The code is now in the REL_1_2 branch and will be included in the 1.2 release.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Yuri - 2012-12-12

What is the status of this issue?
Is XSS attack fix included in 1.2 release?

FreeBSD has been holding the port update pending this issue.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Log in to post a comment.