Old DWR causes CSRF, XSS in Admin Console

Description

We're currently using DWR 1.1.4, which has weaknesses in terms of modern web security. An update to 3.0.2 should be possible, but is a substantial piece of work and impacts a number of cases (Monitoring Plugin and Kraken as well as core).

Environment

None
100% Done
Loading...

Activity

Show:

Daryl Herzmann 
November 13, 2017 at 6:31 PM

change was merged, assumed as resolved

Fixed

Details

Assignee

Reporter

Fix versions

Priority

Created December 21, 2016 at 12:14 PM
Updated February 13, 2018 at 8:40 PM
Resolved November 13, 2017 at 6:31 PM