Uploaded image for project: 'Mesos'
  1. Mesos
  2. MESOS-6947

Fix pailer XSS vulnerability

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • None
    • 1.2.0
    • webui
    • None

    Description

      There exists an XSS vulnerability in pailer.html.

      window.name can be set to an external domain serving js which is wrapped in <script> tags by the getJSON async call. A detailed example will follow acceptance of the patch.

      Attachments

        Activity

          People

            jjanco Jacob Janco
            jjanco Jacob Janco
            haosdent haosdent
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: