Uploaded image for project: 'camunda BPM'
  1. camunda BPM
  2. CAM-6242

Javascript code executable in input fields

XMLWordPrintable

      Use following command 

      <script>window.alert("hallo")</script>

      Following input fields are affected
      Cockpit:
      Process Instance View: User Task Assignee
      Process Instance View: Add string variable with name <script>window.alert("hallo")</script> in the instance modification menu. Subsequently go to variables tab and change the variable type to object. This can also be done by other users --> XSS

      Admin:
      Create new User Menu: User Id*
      Create new Groups Menu: Group Id*

        This is the controller panel for Smart Panels app

            [CAM-6242] Javascript code executable in input fields

            Sebastian Stamm added a comment -

            The Jenkins Jobs for commons-ui are currently failing on some branches, however, the failing test-cases seem to be unrelated to the changes in this issue.

            Sebastian Stamm added a comment - The Jenkins Jobs for commons-ui are currently failing on some branches, however, the failing test-cases seem to be unrelated to the changes in this issue.

              michael.schoettes Michael Schoettes
              michael.schoettes Michael Schoettes
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: