XSS attack possible on JobManager

[Pankaj Chaudhary]

Hi,

 

It seems that the JobManager port, is vulnerable for XSS attack, since the script response in the below example is dumped as is without any sanitization.

Has some one addressed this issue?

 

 

 

Regards

Pankaj.

 

 

 

 

 

This message may contain confidential and privileged information. If it has been sent to you in error, please reply to advise the sender of the error and then immediately delete it. If you are not the intended recipient, do not read, copy, disclose or otherwise use this message. The sender disclaims any liability for such unauthorized use. NOTE that all incoming emails sent to Qualys email accounts will be archived and may be scanned by us and/or by external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.