Project

General

Profile

Actions
Copy link

Bug #9335

open

Stored XSS in HAProxy / haproxy_listeners_edit.php

Added by Jim Pingle almost 6 years ago. Updated almost 6 years ago.

Status:
Feedback
Priority:
Normal
Assignee:
Jim Pingle
Category:
haproxy
Target version:
-
Start date:
02/18/2019
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Affected Version:
All
Affected Plus Version:
Affected Architecture:
All

Description

There is a stored XSS on haproxy_listeners.php via parameters submitted on haproxy_listeners_edit.php:

The following parameters are not encoded before display back to the user:

  • desc
  • table_actionsaclN

Since these are free-form, they can't be fully validated, so adding encoding is sufficient.

Actions
Copy link

Also available in: Atom PDF