Bug #16974
Updated by Jim Pingle 4 days ago
The @acme_accountkeys.php@ page uses ACME account key name in JavaScript with incomplete encoding protection, which can lead to a potential XSS. 1. Create an account key with a name such as: @testkey123@ 2. Create another account key that starts with the same name, but then includes an XSS payload: @testkey123');alert(String.fromCharCode(88,83,83));//@ When attempting to edit the entry by clicking on the pencil icon, or double clicking the entry, the XSS will trigger. Reported by: @lujiefsi