XSL Stylesheet Security Update
Description: Properly encoding admin messages
Categories: Search Appliance, Webinator
Link to this article: Select all
[url=https://forums.thunderstone.com/app.php/kb/viewarticle?a=2&sid=49f54e13be4c69a4f7885da0f7417d44]Knowledge Base - XSL Stylesheet Security Update[/url]
To fix the code you will need to edit the XSL file for the profile, replacing the section that looks like:
Code: Select all
<xsl:otherwise>
<!-- not admin-mode, put the admin message in a
HTML comment -->
<xsl:comment><xsl:value-of select="concat(' ', @code,
' ',@script, ':', @line,
': ', .)"/></xsl:comment>
</xsl:otherwise>
Code: Select all
<xsl:otherwise>
<!-- not admin-mode, put the admin message in a hidden span. <xsl:comment> doesn't escape -->
<span style="display: none">
<xsl:value-of select="concat('admin message: ', @code, ' ',@script, ':', @line, ': ', .)"/>
</span>
</xsl:otherwise>
Nessus plugin 39466 and 49067
CWE #20,CWE #74,CWE #79,CWE #80,CWE #81,CWE #83,CWE #86,CWE #116,CWE #442,CWE #692,CWE #712,CWE #722,CWE #725,CWE #751,CWE #801,CWE #811,CWE #928,CWE #931
XSS