Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[EDITED BY MOC] #3170

Closed
base64linqi opened this issue Jun 4, 2018 · 12 comments
Closed

[EDITED BY MOC] #3170

base64linqi opened this issue Jun 4, 2018 · 12 comments

Comments

@base64linqi
Copy link

base64linqi commented Jun 4, 2018

[EDITED BY MOC]

Thank you your report.

In the future, please report security issues by email to security@e107.org, instead of posting them here in public. I have removed the contents here to prevent abuse, and I have forwarded your report to security@e107.org.

[EDITED BY MOC]

@base64linqi base64linqi changed the title Output without filtering results in xss filtering Output without filtering results in xss Jun 4, 2018
@Moc Moc changed the title Output without filtering results in xss [EDITED BY MOC] Jun 4, 2018
@Moc Moc closed this as completed Jun 4, 2018
@base64linqi
Copy link
Author

Sorry for the security risks of publishing items on the Internet

@base64linqi
Copy link
Author

After repair, I hope you will disclose this vulnerability to public.

@CaMer0n
Copy link
Member

CaMer0n commented Jun 8, 2018

@base64linqi Under "Preferences" in the admin area. What value do you have for "Class which can post <script> ..." ?

image

@base64linqi
Copy link
Author

default

@Moc
Copy link
Member

Moc commented Sep 10, 2018

@base64linqi Yes, I understand how internet works, thank you.

Standard practice is to inform the developers, by the method outlined on their website, of a vulnerability so they are able to fix it it before it being published. Once the fix has been released, there's no objection not to disclose the details to the public.

@base64linqi
Copy link
Author

Is XSS confirmed to exist?

@Moc
Copy link
Member

Moc commented Sep 10, 2018

It is currently being looked into. We'll inform you of further updates.

@base64linqi
Copy link
Author

OK

@fgeek
Copy link

fgeek commented Aug 14, 2021

CVE-2018-11734 has been assigned for this issue. @Moc what release contains a fix for this?

CVE information only contains "In e107 v2.1.7, output without filtering results in XSS."

@Moc
Copy link
Member

Moc commented Aug 14, 2021

This has been fixed. Currently on vacation but I'll post details about which version contains the fix when I get back.

@Moc
Copy link
Member

Moc commented Sep 6, 2021

This has been fixed but I cannot find the exact commit. I would assume the report was treated in the same way as described here: #3414 (comment).

I would therefore use v2.3.0 as the release that fixes this commit.

@base64linqi
Copy link
Author

Yes, it has been repaired ^o^

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants