reflected_xss.png
|
Sub-task |
|||
| depends on |
|
WASA Findings from NSOC Team | Closed |
Team A
[ZBX-12769] Reflected xss vulnerabilities Created: 2017 May 02 Updated: 2024 Apr 10 Resolved: 2017 Sep 12 |
|
| Status: | Closed |
| Project: | ZABBIX BUGS AND ISSUES |
| Component/s: | Frontend (F) |
| Affects Version/s: | 4.0.0alpha1 |
| Fix Version/s: | 2.2.20rc1, 3.0.11rc1, 3.2.8rc1, 3.4.2rc1, 4.0.0alpha1, 4.0 (plan) |
| Type: | Defect (Security) | Priority: | Blocker |
| Reporter: | Vjaceslavs Bogdanovs | Assignee: | Gregory Chalenko |
| Resolution: | Fixed | Votes: | 0 |
| Labels: | frontend, security, xss | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Attachments: |
reflected_xss.png
|
||||||||
| Issue Links: |
|
||||||||
| Team: | Team A |
||||||||
| Sprint: | Sprint 15, Sprint 16 | ||||||||
| Story Points: | 1 | ||||||||
| Description |
|
There are multiple reflected xss vulnerabilities in frontend. POC is the following maliciously crafted link ("zabbix.internal" should be replaced with your domain name): This link leads to a page with item list. Each item name contains onclick handler with injected script. Clicking on any of the item names causes script execution: Another example would be the following link: Click on "Cancel" button will cause execution of injected script. |
| Comments |
| Comment by Gregory Chalenko [ 2017 Aug 22 ] |
|
(1) [F] No translation strings changes. Miks.Kronkalns CLOSED |
| Comment by Miks Kronkalns [ 2017 Sep 04 ] |
|
Code reviewed. |
| Comment by Gregory Chalenko [ 2017 Sep 08 ] |
|
Fixed in:
|
| Comment by Gregory Chalenko [ 2017 Sep 12 ] |
|
Fixed in:
|
