Actions
Bug #16773
closed
Potential XSS in Captive Portal widget
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
26.03.1
Release Notes:
Default
Affected Version:
Affected Architecture:
Description
If a captive portal zone is configured for an authentication method of "None", the user can still submit a username in the POST parameter auth_user. As the portal lacks authentication, this username is not relevant or validated as it would be with other methods. The Captive Portal widget (captive_portal_status.widget.php) displays this username without encoding. The status page is unaffected.
Small POC attached.
Files
Updated by Jim Pingle about 2 months ago
- File 16773.patch 16773.patch added
- Status changed from In Progress to Feedback
- % Done changed from 0 to 100
Fixed by commit 1519891f7636e8e2f7d13d051dc53a6c30366668
Before testing it's also worth applying f01ba7e19574b08a442df00aff934496b2f9976b.
Combined diff attached
Updated by Jim Pingle 26 days ago
- Status changed from Feedback to Resolved
- Private changed from Yes to No
Patch is available in the System Patches package in the Recommended Patches section. Update the package manually if it is already installed.
Updated by Jim Pingle 13 days ago
- Plus Target Version changed from 26.07 to 26.03.1
Actions