bugMHonArc - Bugs: bug #3128, XSS Vulnerabilies

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #3128: XSS Vulnerabilies

Submitted by:  Earl Hood <ehood>
Submitted on:  Sat 05 Apr 2003 11:54:50 PM UTC  
 
Category: MIME FilterSeverity: 3 - Normal
Priority: 5 - NormalItem Group: Security
Status: FixedPrivacy: Public
Assigned to: NoneOpen/Closed: Closed
Operating System: AllPerl Version: All
Component Version: <=2.6.2Fixed Release: 2.6.3

Sat 05 Apr 2003 11:57:18 PM UTC, comment #1:

mhtxthtml.pl modified to deal with these cases.

BTW, Why would recognize javascript URLs with whitespace
characters embedded in them? Kind of stupid if you ask me.

Earl Hood <ehood>
Project Administrator
Sat 05 Apr 2003 11:54:50 PM UTC, original submission:

Copied from private message:

The following constructs all came out as working javascript or SSI
directives after I installed mhonarc v2.6.2 and ran them through
mhonarc -single:

<!-<link>-#exec foo -->

<img src=foo onerror="alert(1)">

<img lowsrc="javas
cript:alert(2)">

<img lowsrc="javas&#9;cript:alert(3)">

Earl Hood <ehood>
Project Administrator

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Sat 05 Apr 2003 11:57:18 PM UTCehoodFixed Release=>
Sat 05 Apr 2003 11:57:17 PM UTCehoodStatusNone=>(Error - Not Found)
  Open/ClosedOpen=>(Error - Not Found)

Back to the top


Powered by Savane 3.1-cleanup1