W3C home > Mailing lists > Public > site-comments@w3.org > May 2001

Cross-site scripting vulnerability in W3C public search engine

From: TAKAGI, Hiromitsu <takagi@etl.go.jp>
Date: Sat, 19 May 2001 04:58:40 -0400 (EDT)
To: site-comments@w3.org
Cc: takagi@etl.go.jp
Message-Id: <20010519173939.F751.TAKAGI@etl.go.jp>
I found a cross-site scripting vulnerability in the W3C public search
engine.

Accessing the following URL, the JavaScript code will be executed on
the w3.org domain by the user's browser.
http://search.w3.org/Public/cgi-bin/query?mss=simple&pg=q&what=web&filter=w3c&fmt=.&q=%3C%2FTITLE%3E%3CSCRIPT%3Ealert%28document.domain%29%3C%2FSCRIPT%3E


For details about cross-site scripting vulnerability, please refer the
following pages.
http://www.microsoft.com/TechNet/security/crssite.asp
http://www.cert.org/advisories/CA-2000-02.html


Best regards,
--
Hiromitsu Takagi
Electrotechnical Laboratory
http://www.etl.go.jp/~takagi/
Received on Monday, 21 May 2001 01:51:26 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Wednesday, 24 October 2012 16:21:26 GMT