bugphpGroupWare - Bugs: bug #13863, Main screen message allows for...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #13863: Main screen message allows for potential security risk

Submitted by:  None
Submitted on:  Wed 20 Jul 2005 02:36:25 PM UTC  
 
Item Group: 0.9.16.000 releaseCategory: API - Admin
Severity: 3 - NormalPriority: 5 - Normal
Status: FixedPrivacy: Public
Assigned to: Dave Hall <skwashd>Open/Closed: Closed
Component Version: NoneOperating System: GNU/Linux - RedHat/Fedora
Reproducibility: Every TimePlanned Release: 0.9.16.011+
Fixed Release: 0.9.16.007

Thu 21 Jul 2005 01:07:31 AM UTC, comment #1:

This is a low risk exploit as admin privledges are required. Will fix it soon.

Next time please email -unavailable- as mentioned on our website.

Dave Hall <skwashd>
Project AdministratorIn charge of this item.
Wed 20 Jul 2005 02:36:25 PM UTC, original submission:

When editing the main screen message from the admin pages, it appears to be possible to include any HTML that you like, which means that this could potentially be abused, either with javascript or other code embedded in the message.

Anonymous

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 8 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Wed 24 Aug 2005 02:11:10 PM UTCskwashdCategoryNone=>API - Admin
  StatusNone=>Fixed
  PrivacyPrivate=>Public
  Open/ClosedOpen=>Closed
  Planned ReleaseNone=>0.9.16.011+
  Fixed Release=>0.9.16.007
Thu 21 Jul 2005 01:10:20 AM UTCskwashdAssigned toNone=>skwashd
Thu 21 Jul 2005 01:07:31 AM UTCskwashdPrivacyPublic=>Private

Back to the top


Powered by Savane 3.1-cleanup1