i find xss in urlhttp://192.168.1.71:8888/rest/getstatus<script>alert(document.cookie)</script>http://192.168.1.71:8888/rest/getstatus
about xss
Several things could have been done to mitigate this attack:
1.The search input could have been sanitized, which would include proper encoding checking. |
2.The web server could be set to redirect invalid requests. |
3.The web server could detect a simultaneous login and invalidate the sessions. |
4.The web server could detect a simultaneous login from two different IP addresses and invalidate the sessions. |
5.The website could display only the last few digits of a previously used credit ca...
Please always mention a lucee version. And there is a ticket in lucee and that’s deployed in version 5.3.8.112. Can you please check with this? LDEV-3023
my lucee version is 5.3.7.48