Example:
Basically if set a campaign that exists but is expired, then the banner parameter is reflected back without escaping.
Making this a subtask of T171987 since its more serious than the stuff on that bug, as you can do this without being an admin.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | None | T171987 CentralNotice: Sanitize data for adding a campaign, changing campaign settings, and displaying info about campaigns | |||
| Resolved | None | T175900 XSS in central notice due to lack of escaping in LoadBanner error handling |
[21:57] bawolff !log deployed patch T175900
We should probably release/publisize this at the same time as related T171987
Great, thanks so much! Quite a terrifying vulnerability... Patch looks great, locally smoke tested and verified that it blocks the attack :)
Introduced in eca170c5919dd78b5be281218460e671c066067d
Fix should be backported to REL1_29 and REL1_30