[JSPWIKI-1107] uploading attachments with illegal filename causes XSS vulnerability

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.11.0-M3
• Component/s: Templates and UI
• Assignee: Unassigned
• Reporter: Harry Metske
• Created: 22/Apr/19 13:04
• Updated: 29/May/19 22:29
• Resolved: 03/May/19 18:41

Description

Create a file with the name <img src=x onerror=alert`1`> and upload this file to an existing page.

You get the JS popup doing the upload, and anyone visiting the download tab of that jsp will also get the JS popup.