[STR-3191] Sufficently filter HTML tag attribute names and values

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 1.2.9, 1.3.10
• Fix Version/s: 1.4.0
• Component/s: Tag Libraries
• Assignee: Paul Benedict
• Reporter: Paul Benedict
• Created: 27/Jul/09 02:31
• Updated: 26/Dec/09 00:49
• Resolved: 16/Sep/09 09:45

Description

Allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to insufficient quoting of parameters.

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-2025
• http://support.novell.com/security/cve/CVE-2008-2025.html