[VELTOOLS-150] VelocityLayoutServlet allows clients to specify "layout" without performing any security checks. - ASF JIRA

XML

Word

Printable

JSON

Details

Type: Bug
Status: Closed
Priority: Critical
Resolution: Fixed
Affects Version/s: 1.4, 2.0
Fix Version/s: 3.0
Component/s: VelocityView
Labels:
- security
Environment:
Velocity 1.7, Velocity Tools 2.0.
Confirmed also affects Velocity 1.4, Velocity Tools 1.4.

Description

For reference:
http://markmail.org/thread/43cz2dymzmxjjrq5

Attachments

Activity

People

Assignee:: Claude Brisson

Reporter:: Christopher Schultz

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Dates

Created:: 05/Jan/12 22:31

Updated:: 29/Sep/18 22:06

Resolved:: 25/Jun/18 22:48