Skip to content

O
Openfire
Commit 20174b68 authored by Dave Cridland's avatar Dave Cridland
Browse files
Options

OF-836 CVE-2015-6972 rXSS in import-keystore... 

Reflected XSS in import-keystore-certificate.jsp via the passphrase.

Reported by Florian Nivette of Sysdream.
parent 36bb0e80
Show whitespace changes
Inline Side-by-side
Showing with 1 addition and 1 deletion
src/web/import-keystore-certificate.jsp
View file @ 20174b68
...@@ -117,7 +117,7 @@ ...@@ -117,7 +117,7 @@
<label for="passPhrase"><fmt:message key="ssl.import.certificate.keystore.pass-phrase" /></label> <label for="passPhrase"><fmt:message key="ssl.import.certificate.keystore.pass-phrase" /></label>
</td> </td>
<td width="99%"> <td width="99%">
<input type="text" size="60" maxlength="200" name="passPhrase" id="passPhrase" value="${param.passPhrase}"> <input type="text" size="60" maxlength="200" name="passPhrase" id="passPhrase" value="<c:out value="${param.passPhrase}"/>">
</td> </td>
</tr> </tr>
<tr valign="top"> <tr valign="top">
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment

Technounit-GROUP 2023