Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Stored XSS in sidebar and in table_data #22

Open
Davidepaalte opened this issue Mar 8, 2018 · 1 comment
Open

Stored XSS in sidebar and in table_data #22

Davidepaalte opened this issue Mar 8, 2018 · 1 comment

Comments

@Davidepaalte
Copy link

The sidebar and table_data are vulnerable to Stored XSS, which means an attacker could store HTML code on the database that would be rendered by the browser when viewed and potentially run malicious code.

This can be fixed in the callColumn function of the SideBarLogic.java and in the DataSelectLogic function of the DataSelectLogic.java using org.apache.commons.lang.StringEscapeUtils.escapeHtml function on the data coming from the database.
@NicoleG25
Copy link

NicoleG25 commented Dec 26, 2019 •
edited
Loading

CVE-2019-1000004 was assigned.

@yugandhargangu

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@Davidepaalte @NicoleG25