Skip to content

XSS and open redirect on login form, CVE-2018-1000671 #268

Closed
@hmpf

Description

@hmpf

The following link redirects to bing:

https://listes.renater.fr/sympa?referer=https://www.bing.com&passwd=&previous_action=&action=login&action_login=&previous_list=&list=&email=

It also works in 6.2.16. We have no newer sympa to test with.

It seems to me maybe this is a bug in a perl dependency? I couldn't find "referer" directly in sympa's source code during a (very) cursory grep.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions