ID: 5399
Title: Fixed multiple stored XSS injections in WATO dialogs
Component: WATO
Level: 1
Class: Security fix
Version: 1.5.0i1
It was possible to inject Javascript code to using configuration fields of different
objects
(users, hosts, groups, roles, timeperiods).
These issues could only be triggered by authenticated users that have permissons to use
WATO
and add/edit the objects mentioned above. Normally these are users with the roles admin
or
users.