This forum is closed to new posts and responses. Individual names altered for privacy purposes. The information contained in this website is provided for informational purposes only and should not be construed as a forum for customer support requests. Any customer support requests should be directed to the official HCL customer support channels below:

HCL Software Customer Support Portal for U.S. Federal Government clients
HCL Software Customer Support Portal


~Dan Bubgerogenynds
Aug 1, 2018, 3:50 PM
2 Posts

XSS Vulnerability

  • Category: Domino Server
  • Platform: Windows
  • Release: 9.0.1
  • Role: Administrator,Developer
  • Tags: XSS,HTTP
  • Replies: 1

Hi,

After scanning for Web vulnerability, we found that our Notes application was subject to be hacked by XSS attack. So we upgraded our Domino server to 9.0.1 FP10 and added

those Notes.ini parameters : HttpOnly=1
HTTPAdditionalRespHeader=X-Frame-Options:SAMEORIGIN

But even with this, the web base application can be fooled by this simple code in a formulary field : <script>alert('bonjour')</script>

Do i miss something ?

Guy.

 


This forum is closed to new posts and responses. Individual names altered for privacy purposes. The information contained in this website is provided for informational purposes only and should not be construed as a forum for customer support requests. Any customer support requests should be directed to the official HCL customer support channels below:

HCL Software Customer Support Portal for U.S. Federal Government clients
HCL Software Customer Support Portal