Bug 2690 - Security Vulnerability Gives me Administrative Access
Summary: Security Vulnerability Gives me Administrative Access
Status: CLOSED WONTFIX
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: unspecified
Hardware: PC All
: P3 critical (vote)
Assignee: Galen Charlton
QA Contact: Bugs List
URL:
Keywords:
Depends on: 3652
Blocks:
  Show dependency treegraph
 
Reported: 2008-10-17 09:36 UTC by Chris Cormack
Modified: 2019-06-27 09:24 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Cormack 2010-05-21 00:54:44 UTC


---- Reported by rsofia@poly.edu 2008-10-17 09:36:37 ----

An XSS vulnerability exists allowing me to send a carefully constructed URL to a librarian via e-mail or messaging agent.  When visited a message is sent back to me with the logged in users session credentials.

Contact me for a proof of concept.



---- Additional Comments From gmcharlt@gmail.com 2008-10-17 09:46:23 ----

Emailed request for additional information.



---- Additional Comments From chris@bigballofwax.co.nz 2009-12-12 10:12:09 ----

Was this ever verified and fixed?



--- Bug imported by chris@bigballofwax.co.nz 2010-05-21 00:54 UTC  ---

This bug was previously known as _bug_ 2690 at http://bugs.koha.org/cgi-bin/bugzilla3/show_bug.cgi?id=2690

Unknown Component Authentication
   Using default product and component set in Parameters 
Actual time not defined. Setting to 0.0
The original reporter of this bug does not have
   an account here. Reassigning to the person who moved
   it here: chris@bigballofwax.co.nz.
   Previous reporter was rsofia@poly.edu.

Comment 1 Katrin Fischer 2011-04-24 14:23:19 UTC
Status?
Comment 2 Katrin Fischer 2012-03-19 06:12:23 UTC
I am marking this WONTFIX, because it seems we don't have enough information to reproduce the bug and there is another open bug about XSS vulnerabilities (bug 3652). Please change status if you think it's not a good idea.