Bug 662912 (CVE-2018-1000528)

Summary:	net-nds/gosa-core: XSS in change password form (html/password.php) (CVE-2018-1000528)
Product:	Gentoo Security	Reporter:	Thomas Deutschmann (RETIRED) <whissi>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	dev-zero
Priority:	Normal	Keywords:	PMASKED
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/gosa-project/gosa-core/issues/14
Whiteboard:	B4 [noglsa upstream/ebuild]
Package list:		Runtime testing required:	---

Description Thomas Deutschmann (RETIRED) gentoo-dev

2018-08-06 00:09:50 UTC

GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/password.php, #308) that can result in injection of arbitrary web script or HTML. This attack appear to be exploitable via the victim must open a specially crafted web page. This vulnerability appears to have been fixed in after commit 56070d6289d47ba3f5918885954dcceb75606001.

Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev

2018-08-06 00:10:29 UTC

Upstream patch:

https://github.com/gosa-project/gosa-core/commit/56070d6289d47ba3f5918885954dcceb75606001

Comment 2 Tiziano Müller (RETIRED) gentoo-dev

2018-11-23 07:32:57 UTC

PMASKED, Pending removal: 2018-12-21

Comment 3 Brian Evans (RETIRED) gentoo-dev

2019-01-23 18:13:35 UTC

Package removed.

@security, ready to continue

Comment 4 Sam James archtester

2020-03-28 06:26:33 UTC

XSS, so noglsa. Tree is clean. Closing.