Tickets :: [#8398] Cross Site Scripting Vulnerability

Summary	Cross Site Scripting Vulnerability
Queue	Passwd
Queue Version	3.1
Type	Bug
State	Resolved
Priority	2. Medium
Owners	Chuck Hagenbuch <chuck (at) horde (dot) org>
Requester	security (at) davidwharton (dot) us
Created	07/03/09 (221 days ago)
Due
Updated	07/05/09 (219 days ago)
Assigned
Resolved	07/05/09 (219 days ago)
Attachments
Milestone
Patch	No

07/05/09	Chuck Hagenbuch	Comment #3 Assigned to Chuck Hagenbuch State ⇒ Resolved	Reply to this comment
Fixed for 3.1.1 - thanks.

07/05/09	CVS Commit	Comment #2	Reply to this comment
Changes have been made in CVS for this ticket: http://cvs.horde.org/diff.php/passwd/docs/CHANGES?rt=horde&r1=1.110&r2=1.111&ty=u http://cvs.horde.org/diff.php/passwd/main.php?rt=horde&r1=1.82&r2=1.83&ty=u http://cvs.horde.org/diff.php/passwd/templates/main/main.inc?rt=horde&r1=1.41&r2=1.42&ty=u

07/03/09	security (at) davidwharton (dot) us	Comment #1 State ⇒ Unconfirmed Patch ⇒ Milestone ⇒ Queue ⇒ Passwd Summary ⇒ Cross Site Scripting Vulnerability Type ⇒ Bug Priority ⇒ 2. Medium	Reply to this comment
A cross site scripting vulnerability exists. Proof of concept: http://hordeserver.com/horde/passwd/main.php?backend="><script>alert('XSS')</script>&userid=stevejobs&return_to=&oldpassword=foo&newpassword0=foo&newpassword1=foo&submit=Change%20Password