Uploaded image for project: 'Nuxeo Platform'
  1. Nuxeo Platform
  2. NXP-13605

Missing Escape in WebEngine gadget module

    XMLWordPrintable

    Details

      Description

      XSS on /nuxeo/site/gadgets?language=%22%3E%3Cqss%3E

      => var language = '"><qss>'; in the generated page

        Attachments

          Activity

            People

            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: