Actions
Bug #16773
closed
Potential XSS in Captive Portal widget
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:
Description
If a captive portal zone is configured for an authentication method of "None", the user can still submit a username in the POST parameter auth_user. As the portal lacks authentication, this username is not relevant or validated as it would be with other methods. The Captive Portal widget (captive_portal_status.widget.php) displays this username without encoding. The status page is unaffected.
Small POC attached.
Files
Updated by Jim Pingle 23 days ago
- File 16773.patch 16773.patch added
- Status changed from In Progress to Feedback
- % Done changed from 0 to 100
Fixed by commit 1519891f7636e8e2f7d13d051dc53a6c30366668
Before testing it's also worth applying f01ba7e19574b08a442df00aff934496b2f9976b.
Combined diff attached
Updated by Jim Pingle about 22 hours ago
- Status changed from Feedback to Resolved
- Private changed from Yes to No
Patch is available in the System Patches package in the Recommended Patches section. Update the package manually if it is already installed.
Actions