---- Reported by rsofia@poly.edu 2008-10-17 09:36:37 ---- An XSS vulnerability exists allowing me to send a carefully constructed URL to a librarian via e-mail or messaging agent. When visited a message is sent back to me with the logged in users session credentials. Contact me for a proof of concept. ---- Additional Comments From gmcharlt@gmail.com 2008-10-17 09:46:23 ---- Emailed request for additional information. ---- Additional Comments From chris@bigballofwax.co.nz 2009-12-12 10:12:09 ---- Was this ever verified and fixed? --- Bug imported by chris@bigballofwax.co.nz 2010-05-21 00:54 UTC --- This bug was previously known as _bug_ 2690 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=2690 Unknown Component Authentication Using default product and component set in Parameters Actual time not defined. Setting to 0.0 The original reporter of this bug does not have an account here. Reassigning to the person who moved it here: chris@bigballofwax.co.nz. Previous reporter was rsofia@poly.edu.
Status?
I am marking this WONTFIX, because it seems we don't have enough information to reproduce the bug and there is another open bug about XSS vulnerabilities (bug 3652). Please change status if you think it's not a good idea.