modoboa / modoboa-webmail

The webmail of Modoboa
MIT License
73 stars 48 forks source link

Fixed XSS issue in To field #244

Closed tonioo closed 1 year ago

codecov[bot] commented 1 year ago

Codecov Report

Base: 77.53% // Head: 77.53% // No change to project coverage :thumbsup:

Coverage data is based on head (8f4e51b) compared to base (dd4ab50). Patch has no changes to coverable lines.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #244 +/- ## ======================================= Coverage 77.53% 77.53% ======================================= Files 24 24 Lines 2195 2195 ======================================= Hits 1702 1702 Misses 493 493 ``` Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=modoboa). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=modoboa)

:umbrella: View full report at Codecov.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.

JeffreyGaor commented 1 year ago

Hi @tonioo

Good day!

Thank you for your update.

It was my pleasure to secure modoboa-webmail.

I can see that my payload previously used ( Bounty">) to trigger XSS when composing email in "TO" field is no longer working.

Moreover, by any chance that you could apply or assign a CVE for the reported vulnerability, please?

Your help is highly appreciated.

Thank you so much.

Regards, Jeffrey