Uploaded image for project: 'Sentry'
  1. Sentry
  2. SENTRY-1665

cross-site scripting vulnerability in ConfServlet

    XMLWordPrintableJSON

    Details

      Description

      The ConfServlet class has the following code:

          String format = request.getParameter(FORMAT_PARAM);
          ...
          } else {
            response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Bad format: " + format);
          }
      

      As a result HTTP parameter is directly written to Servlet error page. Echoing this untrusted input allows for a reflected cross site scripting vulnerability. See http://en.wikipedia.org/wiki/Cross-site_scripting for more information.

        Attachments

        1. SENTRY-1665.001.patch
          1 kB
          Brian Towles
        2. SENTRY-1665.001-sentry-ha-redesign.patch
          2 kB
          Brian Towles

          Issue Links

            Activity

              People

              • Assignee:
                btowles Brian Towles
                Reporter:
                akolb Alex Kolbasov
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: