| |||||||||||||
|
| |||||||||||||
bugzilla - cross site scriptingbugzilla - cross site scriptingPosted Jan 9, 2003 9:44 UTC (Thu) by gerv (subscriber, #3376)Parent article: bugzilla - cross site scripting Debian rewrote the original Bugzilla advisory so it is now seriously misleading. The sentence "Bugzilla does not properly sanitize any input submitted by users." is absolutely not correct. Bugzilla takes great care to sanitise user input. A better sentence might be: "For a period up to two years ago, Bugzilla did not properly sanitize quips submitted by users." At the time, this was a feature, not a bug, but the use of HTML in quips had to be restricted due to abuse. However, we didn't write code to clean up any quips already in the database. So, if you get hit with a cross-site scripting attack, then the malicious party must have added it to your Bugzilla two years ago. The chance of this vulnerability actually affecting anyone is miniscule. Gerv
(Log in to post comments)
|
|
||||||||||||