MantisBT: master edb81799

Author Committer Branch Timestamp Parent
dhx dhx master 2010-09-02 07:51 master 61e90d06
Affected Issues  0012312: NuSOAP WSDL XSS (cross-site scripting vulnerability) in Mantis 1.2.2
Changeset

Fix 0012312: NuSOAP web description XSS vulnerability

Bogdan Calin from Acunetix discovered a number of XSS vulnerabilities in
NuSOAP 0.9.5 (bundled with MantisBT) relating to improperly escaped
URLs.

A sample exploit URL is:
/api/soap/mantisconnect.php?1<ScRiPt>prompt(923395)</ScRiPt>

The upstream report for these XSS flaws in NuSOAP is located at the
following URL:
http://sourceforge.net/projects/nusoap/forums/forum/193579/topic/3834005

This patch provides an interim fix for MantisBT users until upstream
makes a new release.

mod - library/nusoap/nusoap.php Diff File
mod - library/nusoap/class.wsdl.php Diff File