Openbravo Issue Tracking System - Openbravo ERP |
| View Issue Details |
|
| ID | Project | Category | View Status | Date Submitted | Last Update |
| 0012033 | Openbravo ERP | C. Security | public | 2010-01-21 17:59 | 2022-02-01 08:08 |
|
| Reporter | efriese | |
| Assigned To | Triage Platform Base | |
| Priority | high | Severity | major | Reproducibility | always |
| Status | acknowledged | Resolution | open | |
| Platform | | OS | 20 | OS Version | Community Appliance |
| Product Version | | |
| Target Version | | Fixed in Version | | |
| Merge Request Status | |
| Review Assigned To | |
| OBNetwork customer | No |
| Web browser | |
| Modules | Core |
| Support ticket | |
| Regression level | |
| Regression date | |
| Regression introduced in release | |
| Regression introduced by commit | |
| Triggers an Emergency Pack | No |
|
| Summary | 0012033: Cross-site Scripting in BusinessPartner.html |
| Description | The value of inpAD_Org_ID is not validated/escaped to prevent malicious code from being executed in the browser. |
| Steps To Reproduce | The TamperData plugin for Firefox or another proxy will be needed to reproduce. Visit /openbravo/info/BusinessPartner.html while using TamperData to set inpAD_Org_ID to:
inpAD_Org_ID=>%22%27><img%20src%3d%22javascript:alert('XSS')%22>
An alert box will display XSS. |
| Proposed Solution | The value for inpAD_Org_ID should be escaped so that code will not be executed by the browser. More information can be found at http://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29 [^] |
| Additional Information | |
| Tags | No tags attached. |
| Relationships | |
| Attached Files | |
|
| Issue History |
| Date Modified | Username | Field | Change |
| 2010-01-21 17:59 | efriese | New Issue | |
| 2010-01-21 17:59 | efriese | Assigned To | => alostale |
| 2010-01-25 08:15 | alostale | Status | new => scheduled |
| 2010-01-25 08:15 | alostale | Assigned To | alostale => shuehner |
| 2012-02-20 11:21 | shuehner | Assigned To | shuehner => alostale |
| 2012-02-22 15:52 | alostale | Relationship added | blocks 0019842 |
| 2012-02-22 15:53 | alostale | OBNetwork customer | => No |
| 2012-02-22 15:53 | alostale | Type | defect => design defect |
| 2012-09-24 23:39 | AugustoMauch | Note Added: 0052511 | |
| 2012-09-24 23:39 | AugustoMauch | Priority | normal => high |
| 2017-03-31 14:36 | alostale | Status | scheduled => acknowledged |
| 2017-04-10 14:35 | alostale | Assigned To | alostale => platform |
| 2022-02-01 08:08 | alostale | Assigned To | platform => Triage Platform Base |