Project

General

Profile

Actions
Copy link

Bug #16923

closed
JP JP

Potential XSS via inline Firewall Log rule descriptions

Bug #16923: Potential XSS via inline Firewall Log rule descriptions

Added by Jim Pingle 2 months ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
Logging
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

When firewall rule descriptions are enabled in the firewall log (either as a column or row), the rule labels/descriptions are printed to the user without encoding.

Files

Download all files
16923-2.8.1.patch (863 Bytes) 16923-2.8.1.patch Patch for CE 2.8.1 Jim Pingle, 07/01/2026 06:38 PM
16923.patch (956 Bytes) 16923.patch Patch for Plus 26.03.1 Jim Pingle, 07/01/2026 06:38 PM
Actions
Copy link

Also available in: Atom