Actions
Bug #16773
closed
Potential XSS in Captive Portal widget
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:
Description
If a captive portal zone is configured for an authentication method of "None", the user can still submit a username in the POST parameter auth_user. As the portal lacks authentication, this username is not relevant or validated as it would be with other methods. The Captive Portal widget (captive_portal_status.widget.php) displays this username without encoding. The status page is unaffected.
Small POC attached.
Files
Updated by
Actions