Possible XSS in Arnold
Bug #340542 reported by
John-Magne Bredal
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Network Administration Visualized |
Fix Released
|
High
|
John-Magne Bredal | ||
Bug Description
It is possible to use the output variable in Arnold to do a XSS for users using Arnold.
Fix attached.
Revision history for this message
| John-Magne Bredal (john-m-bredal) wrote | #1 |
Revision history for this message
| Morten Brekkevold (mbrekkevold) wrote | #2 |
| Changed in nav: | |
| assignee: | nobody → john-m-bredal |
| importance: | Undecided → High |
| milestone: | none → v3.5.2 |
| status: | New → Confirmed |
| Changed in nav: | |
| status: | Confirmed → Triaged |
Revision history for this message
| Morten Brekkevold (mbrekkevold) wrote | #3 |
| Changed in nav: | |
| status: | Triaged → Fix Released |
To post a comment you must log in.
Thanks, John-Magne. A more permanent fix, though, would be storing messages in the user's session data, instead of having them in the URL.