-
Problem report
-
Resolution: Duplicate
-
Trivial
-
None
-
6.0.0beta1
Problem description: XSS is executable in geomap widget (when clicking on a certain host in widget) by placing script text in the visible name of the host
Example:
Steps to reproduce:
- Create a host with the following string defined in parameter "Visible name" (don't forget to specify coordinates in Inventory tab):
<img src="x" onerror="alert('Im on a map!');"/>
- Open configuration of any Dashboard and and a Geomap widget:
Specify the previously created host in parameter "Host - Save widget and the dashboard
- Open dashboard in view mode and click on the host in the geomap widget
Result: an alert with text "I'm on a map!" is displayed.
Expected: JS defined in host Visible name parameter should not be executed if this host is used in a geomap widget
- part of
-
ZBX-20270 Zoom is broken in geomap initial view
- Closed