https://bugzilla.redhat.com/show_bug.cgi?id=1937445
--- Comment #7 from Todd Cullum <tcullum(a)redhat.com> ---
Flaw summary:
apache-tools' VelocityView, has an error page which appears when a user
attempts to access a non-existent file on the server. It reflects the filename
of the page requested on the error page without first sanitizing the text. This
could allow a malicious actor to execute JavaScript on the page in a reflected
cross-site scripting attack. The (one liner) patch applied in
velocity-tools-view/src/main/java/org/apache/velocity/tools/view/VelocityViewServlet.java
uses the StringEscapeUtils.escapeHtml4() method to first sanitize the input and
prevent such an attack.
--
You are receiving this mail because:
You are on the CC list for the bug.