CVE-2017-14923 (JavaScript, published 2017-09-30T01:29Z)
Description: value: Stored XSS vulnerability via IMG element at "Leadname" of CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript, which is mishandled during rendering by the application administrator and other users.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/tine20/Tine-2.0-Open-Source-Groupware-and-CRM
Files changed:
tine20/Addressbook/js/ContactGrid.js
tine20/Felamimail/js/FolderSelectPanel.js
tine20/Felamimail/js/TreePanel.js
tine20/Filemanager/js/NodeTreePanel.js
tine20/Phone/js/PhoneTreePanel.js
tine20/Tinebase/js/ux/Percentage.js
tine20/Tinebase/js/widgets/ActivitiesPanel.js
tine20/Tinebase/js/widgets/container/TreePanel.js
tine20/Tinebase/js/widgets/grid/FilterPanel.js
tine20/Tinebase/js/widgets/grid/FilterStructureTreePanel.js
tine20/Tinebase/js/widgets/persistentfilter/PickerPanel.js
tine20/Tinebase/js/widgets/relation/GridRenderer.js
tine20/Tinebase/js/widgets/tree/ContextMenu.js
tine20/Tinebase/js/widgets/tree/Loader.js
Commit message: name might not be displayed correctly

Change-Id: I949c7a80b5356f393d269d3004bd6800772ac63b
Reviewed-on: http://gerrit.tine20.com/customers/5618
Reviewed-by: Cornelius Weiss <c.weiss@metaways.de>
Tested-by: Cornelius Weiss <c.weiss@metaways.de>


Vulnerable code:
    return data ? data : ('<div class="renderer_displayNameRenderer_noName">' + i18n._('No name') + '</div>');
    return data;
                    qtip: Tine.Tinebase.common.doubleEncode(record.get('host')),
            qtip: Tine.Tinebase.common.doubleEncode(record.get('host')),
                qtip: Tine.Tinebase.common.doubleEncode(attr.name.name)
        
            text: nodeName,
        })
               : Ext.util.Format.ellipsis(record.data.description, 30);
                qtip: Tine.Tinebase.common.doubleEncode(record.data.description),
        return fileName;
    
       
            text: Ext.util.Format.htmlEncode(attr.name),
            qtip: Tine.Tinebase.common.doubleEncode(attr.name),
        
                filters.push({'condition': 'AND', 'filters': this.filterPanels[id].getValue(), 'id': id, label: this.filterPanels[id].title});
            node.attributes.filterPanel.setTitle(text);
                        qtip : Tine.Tinebase.common.doubleEncode(attr.description ? this.app.i18n._hidden(attr.description) + ' ' + addText : addText),
                return record.getTitle();
                value: node.attributes.longName || node.text,
                                node.setText(_text);
            node.text = node.name = Ext.util.Format.htmlEncode(containerName);

Fixed code:
    return data ? Ext.util.Format.htmlEncode(data) : ('<div class="renderer_displayNameRenderer_noName">' + i18n._('No name') + '</div>');
    return Ext.util.Format.htmlEncode(data);
                    qtip: Ext.util.Format.htmlEncode(record.get('host')),
            qtip: Ext.util.Format.htmlEncode(record.get('host')),
                qtip: Ext.util.Format.htmlEncode(attr.name.name)

            text: Ext.util.Format.htmlEncode(nodeName),
        });
               : Ext.util.Format.ellipsis(Ext.util.Format.htmlEncode(record.data.description), 30);
                qtip: Ext.util.Format.htmlEncode(record.data.description),
        return Ext.util.Format.htmlEncode(fileName);
    fileName = Ext.util.Format.htmlEncode(fileName);

        note = Ext.util.Format.htmlEncode(note);
        
            text: attr.name,
            qtip: attr.name,

        attr.text = Ext.util.Format.htmlEncode(attr.text);
        attr.qtip = Ext.util.Format.htmlEncode(attr.qtip);

                filters.push({'condition': 'AND', 'filters': this.filterPanels[id].getValue(), 'id': id, label: Ext.util.Format.htmlDecode(this.filterPanels[id].title)});
        this.editor.on('startedit', function(el, value) {
            this.editor.setValue(Ext.util.Format.htmlDecode(value));
        }, this);
            node.attributes.filterPanel.setTitle(Ext.util.Format.htmlEncode(text));
                        qtip : Ext.util.Format.htmlEncode(attr.description ? this.app.i18n._hidden(attr.description) + ' ' + addText : addText),
                return Ext.util.Format.htmlEncode(record.getTitle());
                value: Ext.util.Format.htmlDecode(node.attributes.longName || node.text),
                                node.setText(Ext.util.Format.htmlEncode(_text));
            node.text = node.name = containerName;