CVE-2016-15010 (HTML, published 2023-01-05T09:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in University of Cambridge django-ucamlookup up to 1.9.1. Affected by this vulnerability is an unknown functionality of the component Lookup Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.9.2 is able to address this issue. The identifier of the patch is 5e25e4765637ea4b9e0bf5fcd5e9a922abee7eb3. It is recommended to upgrade the affected component. The identifier VDB-217441 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/uisautomation/django-ucamlookup
Files changed:
ucamlookup/templates/admin/auth/lookup_group/add_form.html
ucamlookup/templates/admin/auth/lookup_user/add_form.html
ucamlookup/templates/ucamlookup_groups.html
ucamlookup/templates/ucamlookup_users.html
Commit message: Fix lack of escaping (and so XSS vuln.) in select2 calls

The invocation of Jquery select2 to provide searchable dropdowns
didn't sanitise data coming fom lookup, with the result that any
HTML markup it contained, including <script>...</script>, was
interpreted.

The documentation is difficult to follow, but indications are that the
formater functions (at least formatResult and formatSelection), if
overriden have to do their own escaping of data as necessary. They are
however passed the current global 'escapeMarkup' function as their
final parameter.


Vulnerable code:
            formatResult: function(group) {
                return group.title;
            formatSelection: function(group) {
                return group.title;
            escapeMarkup: function (m) { return m; },
            // we do not want to escape markup since we are displaying html in results
{% endblock %}
            formatResult: function(person) {
                return person.visibleName+" ("+person.crsid+") ";
            formatSelection: function(person) {
                return person.visibleName+" ("+person.crsid+") ";
            escapeMarkup: function (m) { return m; },
            // we do not want to escape markup since we are displaying html in results
{% endblock %}
            formatResult: function(group) {
                return group.title;
            formatSelection: function(group) {
                return group.title;
            escapeMarkup: function (m) { return m; }
            // we do not want to escape markup since we are displaying html in results
</script>
            formatResult: function(person) {
                return person.visibleName+" ("+person.crsid+") ";
            formatSelection: function(person) {
                return person.visibleName+" ("+person.crsid+") ";
            escapeMarkup: function (m) { return m; }
            // we do not want to escape markup since we are displaying html in results
</script>

Fixed code:
            formatResult: function(group, container, query, escapeMarkup) {
                return escapeMarkup(group.title);
            formatSelection: function(group, container, escapeMarkup) {
                return escapeMarkup(group.title);
{% endblock %}
            formatResult: function(person, container, query, escapeMarkup) {
                return escapeMarkup(person.visibleName+" ("+person.crsid+") ");
            formatSelection: function(person, container, escapeMarkup) {
                return escapeMarkup(person.visibleName+" ("+person.crsid+") ");
{% endblock %}
            formatResult: function(group, container, query, escapeMarkup) {
                return escapeMarkup(group.title);
            formatSelection: function(group, container, escapeMarkup) {
                return escapeMarkup(group.title);
</script>
            formatResult: function(person, container, wuery, escapeMarkup) {
                return escapeMarkup(person.visibleName+" ("+person.crsid+") ");
            formatSelection: function(person, container, escapeMarkup) {
                return escapeMarkup(person.visibleName+" ("+person.crsid+") ");
</script>