Project

General

Profile

Actions
Copy link

Bug #10324

closed

system_usermanager_addprivs.php: User account full name is not encoded before output

Added by Jim Pingle over 4 years ago. Updated over 4 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
User Manager / Privileges
Target version:
2.4.5
Start date:
03/09/2020
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
All
Affected Architecture:
All

Description

On system_usermanager_addprivs.php, the user name and full name are displayed at the top of the page for reference. The full name is not encoded before output, leading to a potential XSS.

Actions
Copy link

Also available in: Atom PDF