diff options
| -rw-r--r-- | doc/security.mdwn | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/doc/security.mdwn b/doc/security.mdwn index 4fa531eb1..e636a0e45 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -453,3 +453,12 @@ preview or moderation of comments with such a configuration. These problems were discovered on 12 November 2010 and fixed the same hour with the release of ikiwiki 3.20101112. ([[!cve CVE-2010-1673]]) + +## javascript insertation via insufficient checking in comments + +Dave B noticed that attempting to comment on an illegal page name could be +used for an XSS attack. + +This hole was discovered on 22 Jan 2011 and fixed the same day with +the release of ikiwiki 3.20110122. An upgrade is recommended for sites +with the comments plugin enabled. |