Description
Version: site-toolkit-core-2.02.12-sources.jar
There exists a XSS vulnerability in class: org.hippoecm.hst.core.template.module.query.SearchResult
See method computePagesAndLinks():
- Values are taken from the 'parameterMap' without escaping the values.
- The unescaped value are put in the Page.link variabele which can be accessed directly on a webpage => introducing the possibility of a XSS hack.
Could you verify if this problem still exists in a newer version of de site-toolkit-core?
Attachments
Issue Links
- relates to
-
ARCHE-42 Once HST 2.20.02 is released, include its XSSUrlFilter in the web.xml
- Closed
-
GOGREEN-431 Once HST 2.20.02 is released, include its XSSUrlFilter in the web.xml
- Closed