Re: CVE-2020-13959: Velocity Tools XSS Vulnerability
"Bolz, Michael" <[email protected]> Thu, 18 Mar 2021 07:42:14 +0000
| Newsgroups | gmane.comp.jakarta.velocity.user |
|---|---|
| Message-ID | <[email protected]> |
--_000_9F7292324B1A49849BFF097F061C1567sapcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSB3b3VsZCByZXBvcnQgdGhpcyBpc3N1ZSBpbiB0aGUgcHJvamVjdCB0aGF0IGRlcGVuZHMgb24g dGhlIG9sZA0KVmVsb2NpdHkgdmVyc2lvbiwgbWF5YmUgdGhleSB3aWxsIGZpeCBpdCBvciBpbiB0 aGUgd29yc3QgY2FzZSBzY2VuYXJpbw0KeW91IHdpbGwgaGF2ZSB0byBwcmVwYXJlIGEgUFIgLSBo b3BlZnVsbHkgdGhleSB3aWxsIG1lcmdlIGl0IHF1aWNrbHkNCjopDQoNClRoaXMgd2FzIHdoYXQg SSBzdGFydGVkIGluIHBhcmFsbGVsIHRvIG15IGludmVzdGlnYXRpb24gaWYgMS43IGlzIHZ1bG5l cmFibGUgb3Igbm90IDtvKQ0KVW5mb3J0dW5hdGVseSB0aGUgbGlicmFyeSBvcGVuc2FtbCBbMV1b Ml0gbGlicmFyeSB3aGljaCBoYXZlIHRoZSBkZXBlbmRlbmN5IHRvIFZlbG9jaXR5IDEuNyBzZWVt cyBzb21laG93IGFjdGl2ZSAobGFzdCByZWxlYXNlIEZlYnJ1YXJ5IDIwMjEpIGJ1dCBJIGRpZCBu b3QgZmluZCBhbnkgaGludCB0byB0aGUgcmVsYXRlZCBzb3VyY2UgY29kZSByZXBvIDtvKA0KTm93 IEkgdHJ5IG15IGx1Y2sgd2l0aCB0aGUgcHJvamVjdCBob21lcGFnZSBhbmQgdGhlaXIgaXNzdWUg dHJhY2tlciA7bykNCg0KWzFdOiBodHRwczovL3NlYXJjaC5tYXZlbi5vcmcvYXJ0aWZhY3Qvb3Jn Lm9wZW5zYW1sL29wZW5zYW1sLXNhbWwtaW1wbC8zLjQuNi9qYXI8aHR0cHM6Ly9zZWFyY2gubWF2 ZW4ub3JnL2FydGlmYWN0L29yZy5vcGVuc2FtbC9vcGVuc2FtbC1jb3JlLzMuNC42L2phcj4NClsy XTogaHR0cHM6Ly9tdm5yZXBvc2l0b3J5LmNvbS9hcnRpZmFjdC9vcmcub3BlbnNhbWwvb3BlbnNh bWwtc2FtbC1pbXBsLzMuNC42DQpbM106IGh0dHBzOi8vd2lraS5zaGliYm9sZXRoLm5ldC9jb25m bHVlbmNlL2Rpc3BsYXkvT1NBTUwvSG9tZQ0KWzRdOiBodHRwczovL2lzc3Vlcy5zaGliYm9sZXRo Lm5ldC9qaXJhL3Byb2plY3RzL09TSi9pc3N1ZXMvT1NKLTMxOD9maWx0ZXI9YWxsb3Blbmlzc3Vl cw0KDQoNCk9uIDE4LiBNYXIgMjAyMSwgYXQgMDg6MjYsIEx1a2FzeiBMZW5hcnQgPGx1a2Fzemxl bmFydEBhcGFjaGUub3JnPG1haWx0bzpsdWthc3psZW5hcnRAYXBhY2hlLm9yZz4+IHdyb3RlOg0K DQpjencuLCAxOCBtYXIgMjAyMSBvIDA4OjIwIEJvbHosIE1pY2hhZWwgPG1pY2hhZWwuYm9sekBz YXAuY29tPG1haWx0bzptaWNoYWVsLmJvbHpAc2FwLmNvbT4+IG5hcGlzYcWCKGEpOg0KVW5mb3J0 dW5hdGVseSB3ZSBoYXZlIG5vdCB0aGUgb3B0aW9uIHRvIGVhc2lseSB1cGRhdGUgdG8gdGhlIG5l dyBhcnRpZmFjdHMuDQpBcyB3ZSBnZXQgVmVsb2NpdHkgMS43IGFzIGEgdHJhbnNpdGl2ZSBkZXBl bmRlbmN5Lg0KRXZlbiBpZiB3ZSBleGNsdWRlIHRoZSBvbGQgMS43IHZlcnNpb24gYW5kIGFkZCB0 aGUgMi4zIHZlcnNpb24gd2UgZXhwZWN0IHByb2JsZW1zIGJhc2VkIG9uIHRoZSBiZWhhdmlvdXIg YW5kIEFQSSBjaGFuZ2VzIG1lbnRpb25lZCBbMV0uDQoNCkhlbmNlLCB3ZSB0cnkgdG8gdW5kZXJz dGFuZCBpZiBWZWxvY2l0eSAxLjcgaXMgYWZmZWN0ZWQgYnkgdGhlIENWRS0yMDIwLTEzOTU5IHZ1 bG5lcmFiaWxpdHkuDQpBdCBsZWFzdCBjdXJyZW50bHkgaXQgbG9va3MgbGlrZSBpdCBpcyBhZmZl Y3RlZCwgYXMgdGhlIDIueCBhbmQgMS54IGhhcyB0aGUgc2FtZSBjb2RlYmFzZSAoYXMgZmFyIGFz IEkgdW5kZXJzdGFuZCkuDQoNCkkgd291bGQgcmVwb3J0IHRoaXMgaXNzdWUgaW4gdGhlIHByb2pl Y3QgdGhhdCBkZXBlbmRzIG9uIHRoZSBvbGQNClZlbG9jaXR5IHZlcnNpb24sIG1heWJlIHRoZXkg d2lsbCBmaXggaXQgb3IgaW4gdGhlIHdvcnN0IGNhc2Ugc2NlbmFyaW8NCnlvdSB3aWxsIGhhdmUg dG8gcHJlcGFyZSBhIFBSIC0gaG9wZWZ1bGx5IHRoZXkgd2lsbCBtZXJnZSBpdCBxdWlja2x5DQo6 KQ0KDQoNClJlZ2FyZHMNCi0tDQrFgXVrYXN6DQorIDQ4IDYwNiAzMjMgMTIyIGh0dHA6Ly93d3cu bGVuYXJ0Lm9yZy5wbC8NCg0KLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpUbyB1bnN1YnNjcmliZSwgZS1tYWlsOiB1 c2VyLXVuc3Vic2NyaWJlQHZlbG9jaXR5LmFwYWNoZS5vcmc8bWFpbHRvOnVzZXItdW5zdWJzY3Jp YmVAdmVsb2NpdHkuYXBhY2hlLm9yZz4NCkZvciBhZGRpdGlvbmFsIGNvbW1hbmRzLCBlLW1haWw6 IHVzZXItaGVscEB2ZWxvY2l0eS5hcGFjaGUub3JnPG1haWx0bzp1c2VyLWhlbHBAdmVsb2NpdHku YXBhY2hlLm9yZz4NCg0KDQo= --_000_9F7292324B1A49849BFF097F061C1567sapcom_--