Jforum Cross Scripting problem

[Sudhir Tandon]

What is the time line for the patch implementation of Jforum for plugging up Cross scripting Vulnerability of Jforum ?



CVE-2013-3053
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130311-0_jforum_persistent_xss_v10.txt

[Ulf Dittmer]

Welcome to JavaRanch.

JForum 2.1.9 is obsolete, the chances of it being fixed are just about zero, IMO. The fix mentioned probably made it into the development version of JForum 3, which has at present no projected release date.

Instead of JForum 2.1.9, you should be using the fork at https://code.google.com/p/jforum2/ (to which I happen to be a committer). I'm not sure if that is still vulnerable; I'll try to find out.

[Ulf Dittmer]

Tests confirm that JForum 2.3.x is not susceptible to this vulnerability. This is not the only XSS vulnerability in JForum 2.1.9 that was fixed along the route to 2.3.x.

[Jeanne Boyarsky]

While this isn't an official patch, I've written up how JForum does XSS security, some background and the patch..

Crossposting the patch here since it is only one line. In bb_config.xml, change
<font color='$1'>$2</font>
to
<font color="$1">$2</font>