MantisBT: master-1.3.x 796a327f

Diff Back to Repository
Author Committer Branch Timestamp Parent
atrol dregad master-1.3.x 2019-08-25 01:52 master-1.3.x 404e3df8
Affected Issues  0026078: CVE-2019-15539: Stored XSS on Project Documentation
 0026079: CVE-2019-15539: Stored XSS on Project Documentation
Changeset

Fix XSS on project documentation

Vulnerability in deprecated project documentation functionality
($g_enable_project_documentation), allowing execution of arbitrary
code (if CSP settings permit it) after uploading an attachment with a
crafted filename.

Prevent the attack by sanitizing the filename before display.

Fixes 0026079 (clone of issue 0026078)

(cherry picked from commit bd094dede74ff6e313e286e949e2387233a96eea)
mod - proj_doc_edit_page.php Diff File