Actions
Bug #16918
closed
JP
JP
Potential stored XSS in ``browser.php`` used by ``diag_edit.php``
Bug #16918:
Potential stored XSS in ``browser.php`` used by ``diag_edit.php``
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:
Description
The file browser component of diag_edit.php at /usr/local/www/vendor/filebrowser/browser.php has a potential stored XSS in its handling of directory names.
Directory names are used in JavaScript with partial encoding that can still be leveraged for XSS.
If an attacker with the ability to create arbitrary directories on the filesystem can create a directory with a specially-crafted name and then an administrator navigates to that directory when browsing files to edit, it could trigger an XSS.
An example of a problematic directory is:
payload');alert(1);if('a'=='a
Files
Actions