MARC Editor XSS vulnerability
Bug #1902965 reported by
James Fournie
This bug affects 3 people
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Evergreen |
Fix Released
|
Critical
|
Unassigned | ||
3.4 |
Won't Fix
|
Critical
|
Unassigned | ||
3.5 |
Fix Released
|
Critical
|
Unassigned | ||
3.6 |
Fix Released
|
Critical
|
Unassigned |
Bug Description
MARC 856 fields are vulnerable to cross-site scripting.
=856 40$u"><
Will execute the javascript. This would make it possible for me to steal an auth token if someone is logged into the OPAC or staff client.
Changed in evergreen: | |
status: | New → Confirmed |
importance: | Undecided → Critical |
Changed in evergreen: | |
assignee: | nobody → Jeff Davis (jdavis-sitka) |
Changed in evergreen: | |
assignee: | nobody → Jeff Davis (jdavis-sitka) |
Changed in evergreen: | |
milestone: | none → 3.7-beta |
Changed in evergreen: | |
milestone: | 3.7-beta → none |
Changed in evergreen: | |
milestone: | none → 3.7-beta |
Changed in evergreen: | |
assignee: | nobody → Jason Stephenson (jstephenson) |
tags: | added: needsreleasenote |
Changed in evergreen: | |
assignee: | nobody → Jeff Davis (jdavis-sitka) |
Changed in evergreen: | |
assignee: | nobody → Jason Stephenson (jstephenson) |
Changed in evergreen: | |
status: | Confirmed → Fix Committed |
Changed in evergreen: | |
status: | Fix Committed → Fix Released |
status: | Fix Released → Fix Committed |
information type: | Private Security → Public Security |
Changed in evergreen: | |
status: | Fix Committed → Fix Released |
To post a comment you must log in.
This also affects the $y and maybe other MARC fields that render to HTML