I would like to report a vulnerability (cross-site-scripting) which I have observed in current version v10.5.4 and before.
Cross-Site Scripting (XSS) allows attacker to inject the malicious JavaScript as user input and then malicious script can access any cookies, session tokens, or other sensitive information associated with impacted applications.
Hello Team,
I would like to report a vulnerability (cross-site-scripting) which I have observed in current version v10.5.4 and before.
Cross-Site Scripting (XSS) allows attacker to inject the malicious JavaScript as user input and then malicious script can access any cookies, session tokens, or other sensitive information associated with impacted applications.
Please refer https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) for more details.
Impacted URL is http://[your_webserver_ip]/opencms/system/workplace/admin/accounts/user_new.jsp
Steps to reproduce:
TestXSS<img+src=x+onmouseover=alert(document.domain)>in First Name and Last Name field.Version details:
Best Regards
https://github.com/varchashva
varchashva [at] gmail [dot] com
The text was updated successfully, but these errors were encountered: