Change Details

A security researcher presenting themselves as "**Ϡ**" has reported to security@ a reflected XSS archiva.wikimedia.org. **Steps to reproduce:** # Navigate to https://archiva.wikimedia.org/css/;%22%3E%3Csvg/onload=alert(document.domain)%3E The payload - `;"><svg/onload=alert(document.domain)>` - (and similar) appears to work under any random directory with what appears to be Jetty's default listing capabilities enabled. I'm wondering if that could simply be disabled? cc: @Ottomata @elukey

A security researcher presenting themselves as "**Ϡ**" has reported to security@ a reflected XSS archiva.wikimedia.org. **Steps to reproduce:** # Navigate to https://archiva.wikimedia.org/css/;%22%3E%3Csvg/onload=alert(document.domain)%3E The payload - `;"><svg/onload=alert(document.domain)>` - (and similar) appears to work under any random directory with what appears to be Jetty's default directory listing capabilities enabled. I'm wondering if that could simply be disabled? cc: @Ottomata @elukey

A security researcher presenting themselves as "**Ϡ**" has reported to security@ a reflected XSS archiva.wikimedia.org. **Steps to reproduce:** # Navigate to https://archiva.wikimedia.org/css/;%22%3E%3Csvg/onload=alert(document.domain)%3E The payload - `;"><svg/onload=alert(document.domain)>` - (and similar) appears to work under any random directory with what appears to be Jetty's default directory listing capabilities enabled. I'm wondering if that could simply be disabled? cc: @Ottomata @elukey