Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #3261 XSS vulnerability in Docman
    Actions
    Infos
    #3261
    Mohamed Amin Doghri (doghrim)
    2013-05-07 18:24
    2013-05-02 17:38
    2081
    Details
    XSS vulnerability in Docman
    Js code is interpreted by navigator when put in URL.

    To reproduce :

    Login in tuleap

    Go to : https://tuleap.net/plugins/docman/?group_id=101&action=show&id=421&report=Tree"onmouseover="alert(255)"

    You will get an alert(255) if you overfly document links

    Doc/Documentation manager
    Empty
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Denis PILAT (denis_pilat), Ahmed HOSNI (hosniah)
    Stage
    Mohamed Amin Doghri (doghrim)
    Closed
    2013-05-07
    Attachments
    Artifact links
    Empty
    Empty
    References
    References list is empty
    Display settings

    Follow-ups

    User avatar
    Nicolas Terray (nterray)2013-05-07 18:24
    Available in Tuleap 6.0.99.1
    • Status changed from Under implementation to Closed
    • Close date set to 2013-05-07
    • Is an Enhancement or an internal improvement? set to
    User avatar
    Yannis ROSSETTO (rossettoy)2013-05-02 17:57
    Hello,

    I reproduce the bug. We will have a look on it quickly !
    • Category set to Doc/Documentation manager
    • Status changed from New to Verified
    • Platform set to