Kunena 7.0.11 & Kunena 6.4.16 – Security Updates Released and K7.1 in RC1 2

The Kunena team has announce the arrival of three simultaneous security release : K6.4.16, K7.0.11 and K7.1 RC2. Just a reminder K6.4.16 receives only securities fixes untill end of 2026, so it's advised for users to upgrade to K7.0.11. K7.0.11 is the last release of the K7.0 because it's replaced by K7.1 branch with the stable release in the corner. The translations for K7.1 on crowdin.com/project/kunena-forum-7-1 needs to be checked or improved becasue it has been generated by TM (Translation Machine).

Question Cross-Site Scripting Problem (Java)

More
7 years 1 month ago - 7 years 1 month ago #211177 by reufelss
Cross-Site Scripting Problem (Java) was created by reufelss
Hello, we have just installed version 5.1.14 and now 5.1.15 DEV. Unfortunately, Java scripts, e.g. when replying to posts, can be execute in the header.

We testet it with the script "><script>alert(1)</script>

This will be a security problem. What can we do?

Best regards
Stefan
Last edit: 7 years 1 month ago by reufelss. Reason: incl. Images

Please Log in or Create an account to join the conversation.

More
7 years 1 month ago #211184 by rich
Replied by rich on topic Cross-Site Scripting Problem (Java)
You have tried to add images here: www.kunena.org/forum/76-Official-Announc...curity-update#211132
Please add the images again here but do not use the browser back option if you want to add images, otherwise the attachments will not uploaded.
Important! Always create a backup before you make any changes to your website!

Please Log in or Create an account to join the conversation.

More
7 years 1 month ago #211198 by YourFavoriteSpamBot
Replied by YourFavoriteSpamBot on topic Cross-Site Scripting Problem (Java)

reufelss wrote: Hello, we have just installed version 5.1.14 and now 5.1.15 DEV. Unfortunately, Java scripts, e.g. when replying to posts, can be execute in the header.

We testet it with the script "><script>alert(1)</script>

This will be a security problem. What can we do?

Best regards
Stefan


Got more information e.g. exact location or some screenshots?
If there is still any issue I'm interested to know more (yet, this might not be the right place to publicly discuss security issues^^)

Please Log in or Create an account to join the conversation.

Time to create page: 0.107 seconds