Re: [Geoserver-users] Handling of a detected security flaw

Fri, 09 May 2014 08:38:22 -0700 

For css read xss (Spell checker)

Russ

On 9 May 2014, at 16:30, Russell Hore <[email protected]> wrote:

> I just tried that on my 2.5 box and got a popup with css in it.
> 
> Build Information            
> Version 2.5
> Git Revision 8cf3edcf5f61db010f7ad3fcb4613e7c0eabeaff
> Build Date 18-Mar-2014 16:08
> GeoTools Version 11.0 (rev fb9a2d3f88315d076523788cb8196ec89bb253f9)
> GeoWebCache Version 1.5.1 (rev 1.5.x/64246c20a4ada1c954b17d23b9447408d1c5432f)
> 
> 
> Russ
> 
> On 9 May 2014, at 16:17, Isakson Mats <[email protected]> wrote:
> 
>> http://demo.opengeo.org/geoserver/ows?SERVICE=WFS&request=";><a%20xmlns:a=%27http://www.w3.org/1999/xhtml%27><a:body%20onload="alert%28%27xss%27%29"/></a><"&VERSION=1.0
> 


------------------------------------------------------------------------------
Is your legacy SCM system holding you back? Join Perforce May 7 to find out:
&#149; 3 signs your SCM is hindering your productivity
&#149; Requirements for releasing software faster
&#149; Expert tips and advice for migrating your SCM now
http://p.sf.net/sfu/perforce
_______________________________________________
Geoserver-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/geoserver-users

Reply via email to