phpGroupWare - Bugs: bug #13863, Main screen message allows for...
You are not allowed to post comments on this tracker with your current authentication level.
bug #13863: Main screen message allows for potential security risk
Submitter: | None | ||
Submitted: | Wed 20 Jul 2005 02:36:25 PM UTC | ||
Item Group: | 0.9.16.000 release | Category: | API - Admin |
Severity: | 3 - Normal | Priority: | 5 - Normal |
Status: | Fixed | Privacy: | Public |
Assigned to: | skwashd | Open/Closed: | Closed |
Component Version: | None | Operating System: | GNU/Linux - RedHat/Fedora |
Reproducibility: | Every Time | Planned Release: | 0.9.16.011+ |
Fixed Release: | 0.9.16.007 |
Thu 21 Jul 2005 01:07:31 AM UTC, comment #1: |
Dave Hall <skwashd>![]() ![]() |
Wed 20 Jul 2005 02:36:25 PM UTC, original submission:
When editing the main screen message from the admin pages, it appears to be possible to include any HTML that you like, which means that this could potentially be abused, either with javascript or other code embedded in the message. |
Anonymous |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
CC list is empty
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 8 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2005-08-24 | skwashd | Category | None | ![]() |
API - Admin |
Status | None | ![]() |
Fixed | ||
Privacy | Private | ![]() |
Public | ||
Open/Closed | Open | ![]() |
Closed | ||
Planned Release | None | ![]() |
0.9.16.011+ | ||
Fixed Release | ![]() |
0.9.16.007 | |||
2005-07-21 | skwashd | Assigned to | None | ![]() |
skwashd |
2005-07-21 | skwashd | Privacy | Public | ![]() |
Private |
This is a low risk exploit as admin privledges are required. Will fix it soon.
Next time please email -email is unavailable- as mentioned on our website.