XSS Vulnerabilities under Console->Syslog xxx

[ddb4github]

Describe the bug

Syslog alert/removal/report popup alert during XSS testing.

To Reproduce

Case#1

1. Create a Syslog Alert, input <script>alert('test CVE');</script> for all text/area fields
2. Click Save button, and return to list page
3. alert will popup three times, as screenshot below.

Case#2

1. Create a Syslog Alert(or Removal, Report).
2. Input <script>alert('test CVE');</script> in name field.
3. Click Save button, and return list page,
4. Click list item, and select one.
5. Select Delete from action list
6. Click Go
7. alert popup

[netniV]

This should have a CVE recorded for it, can you get one?

[ddb4github]

This should have a CVE recorded for it, can you get one?

Request CVE ID yesterday. still not reviewed now

[netniV]

Is this the same CVE as the core or a separate one for the plugin?

[ddb4github]

Is this the same CVE as the core or a separate one for the plugin?

I plan to request separate CVE ID for syslog/thold once the my first CVE ID processed. But the first one is still under review. I'm not sure if any program issue.