Uploaded image for project: 'AeroGear'
  1. AeroGear
  2. AEROGEAR-715

Malicious attackers can easily bypass the login page using XSS

    XMLWordPrintable

Details

    • Feature Request
    • Resolution: Done
    • Major
    • 1.0.0.M8
    • 1.0.0.M7, 1.0.0.M8
    • controller , examples, security
    • None

    Description

      • Login

      curl -d "aeroGearUser.password=Abc123&aeroGearUser.id=%22'%3CaXliE%3E" http://controller-aerogear.rhcloud.com/aerogear-controller-demo/login

      Attachments

        Activity

          People

            boliveir_managed_kafka_security (inactive user) Bruno Oliveira Silva (Inactive)
            boliveir_managed_kafka_security (inactive user) Bruno Oliveira Silva (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: