Stored XSS in previous password field

[lebik]

Steps to reproduce

1. Add a new item to any folder, set a password with XSS payload:

"><img src=x onerror=prompt(1)>

2. Edit the previous saved item, change the password to any you want
3. Reload the page.

That's all... we can tap to the item and XSS payload will be executed (because there isn't any filtration in previous used passwords field).
Besides, XSS payload will be executed if you try to look at the change history.

So we have two places where there isn't any filtration.
An attacker can share the item to admin and get admin's cookie for example.

[NicoleG25]

Hi @nilsteampassnet ,
Do you know if this issue was ever addressed? it appears to be assigned CVE-2019-16904
Thanks in advance !

[lebik]

Hi @NicoleG25 , yep, it's CVE-2019-16904