{"action":"closed","issue":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/4603","repository_url":"https://api.github.com/repos/Graylog2/graylog2-server","labels_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/4603/labels{/name}","comments_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/4603/comments","events_url":"https://api.github.com/repos/Graylog2/graylog2-server/issues/4603/events","html_url":"https://github.com/Graylog2/graylog2-server/issues/4603","id":299050808,"node_id":"MDU6SXNzdWUyOTkwNTA4MDg=","number":4603,"title":"XSS scripting in bootstrap <3.3.7","user":{"login":"pbr0ck3r","id":5331286,"node_id":"MDQ6VXNlcjUzMzEyODY=","avatar_url":"https://avatars1.githubusercontent.com/u/5331286?v=4","gravatar_id":"","url":"https://api.github.com/users/pbr0ck3r","html_url":"https://github.com/pbr0ck3r","followers_url":"https://api.github.com/users/pbr0ck3r/followers","following_url":"https://api.github.com/users/pbr0ck3r/following{/other_user}","gists_url":"https://api.github.com/users/pbr0ck3r/gists{/gist_id}","starred_url":"https://api.github.com/users/pbr0ck3r/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pbr0ck3r/subscriptions","organizations_url":"https://api.github.com/users/pbr0ck3r/orgs","repos_url":"https://api.github.com/users/pbr0ck3r/repos","events_url":"https://api.github.com/users/pbr0ck3r/events{/privacy}","received_events_url":"https://api.github.com/users/pbr0ck3r/received_events","type":"User","site_admin":false},"labels":[{"id":104208911,"node_id":"MDU6TGFiZWwxMDQyMDg5MTE=","url":"https://api.github.com/repos/Graylog2/graylog2-server/labels/bug","name":"bug","color":"e11d21","default":true},{"id":222229049,"node_id":"MDU6TGFiZWwyMjIyMjkwNDk=","url":"https://api.github.com/repos/Graylog2/graylog2-server/labels/triaged","name":"triaged","color":"ededed","default":false}],"state":"closed","locked":false,"assignee":{"login":"edmundoa","id":716185,"node_id":"MDQ6VXNlcjcxNjE4NQ==","avatar_url":"https://avatars3.githubusercontent.com/u/716185?v=4","gravatar_id":"","url":"https://api.github.com/users/edmundoa","html_url":"https://github.com/edmundoa","followers_url":"https://api.github.com/users/edmundoa/followers","following_url":"https://api.github.com/users/edmundoa/following{/other_user}","gists_url":"https://api.github.com/users/edmundoa/gists{/gist_id}","starred_url":"https://api.github.com/users/edmundoa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edmundoa/subscriptions","organizations_url":"https://api.github.com/users/edmundoa/orgs","repos_url":"https://api.github.com/users/edmundoa/repos","events_url":"https://api.github.com/users/edmundoa/events{/privacy}","received_events_url":"https://api.github.com/users/edmundoa/received_events","type":"User","site_admin":false},"assignees":[{"login":"edmundoa","id":716185,"node_id":"MDQ6VXNlcjcxNjE4NQ==","avatar_url":"https://avatars3.githubusercontent.com/u/716185?v=4","gravatar_id":"","url":"https://api.github.com/users/edmundoa","html_url":"https://github.com/edmundoa","followers_url":"https://api.github.com/users/edmundoa/followers","following_url":"https://api.github.com/users/edmundoa/following{/other_user}","gists_url":"https://api.github.com/users/edmundoa/gists{/gist_id}","starred_url":"https://api.github.com/users/edmundoa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edmundoa/subscriptions","organizations_url":"https://api.github.com/users/edmundoa/orgs","repos_url":"https://api.github.com/users/edmundoa/repos","events_url":"https://api.github.com/users/edmundoa/events{/privacy}","received_events_url":"https://api.github.com/users/edmundoa/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/Graylog2/graylog2-server/milestones/57","html_url":"https://github.com/Graylog2/graylog2-server/milestone/57","labels_url":"https://api.github.com/repos/Graylog2/graylog2-server/milestones/57/labels","id":1905313,"node_id":"MDk6TWlsZXN0b25lMTkwNTMxMw==","number":57,"title":"3.0.0","description":"Next major release of Graylog.\r\n\r\nFeatures and bug fixes that require external API changes will land here.","creator":{"login":"bernd","id":461,"node_id":"MDQ6VXNlcjQ2MQ==","avatar_url":"https://avatars2.githubusercontent.com/u/461?v=4","gravatar_id":"","url":"https://api.github.com/users/bernd","html_url":"https://github.com/bernd","followers_url":"https://api.github.com/users/bernd/followers","following_url":"https://api.github.com/users/bernd/following{/other_user}","gists_url":"https://api.github.com/users/bernd/gists{/gist_id}","starred_url":"https://api.github.com/users/bernd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bernd/subscriptions","organizations_url":"https://api.github.com/users/bernd/orgs","repos_url":"https://api.github.com/users/bernd/repos","events_url":"https://api.github.com/users/bernd/events{/privacy}","received_events_url":"https://api.github.com/users/bernd/received_events","type":"User","site_admin":false},"open_issues":72,"closed_issues":495,"state":"open","created_at":"2016-07-26T16:18:58Z","updated_at":"2018-12-19T17:45:04Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2018-02-21T17:02:02Z","updated_at":"2018-12-19T17:45:03Z","closed_at":"2018-12-19T17:45:03Z","author_association":"CONTRIBUTOR","body":"<!--- Provide a general summary of the issue in the Title above -->\r\n\r\n## Expected Behavior\r\n<!--- If you're describing a bug, tell us what should happen -->\r\n<!--- If you're suggesting a change/improvement, tell us how it should work -->\r\nDon't allow XSS.\r\n\r\n## Current Behavior\r\n<!--- If describing a bug, tell us what happens instead of the expected behavior -->\r\n<!--- If suggesting a change/improvement, explain the difference from current behavior -->\r\nBootstrap 3.3.7 is are vulnerable to Cross-Site Scripting (XSS) attacks via the data-target attribute.\r\nhttps://snyk.io/vuln/npm:bootstrap:20160627\r\nFixed in: https://github.com/twbs/bootstrap/pull/23687\r\n\r\n## Possible Solution\r\n<!--- Not obligatory, but suggest a fix/reason for the bug, -->\r\n<!--- or ideas how to implement the addition or change -->\r\n- Update to bootstrap 4.0.0 or version 3.4.0 when it is released (currently in dev).\r\n\r\n## Steps to Reproduce (for bugs)\r\n<!--- Provide a link to a live example, or an unambiguous set of steps to -->\r\n<!--- reproduce this bug. Include code to reproduce, if relevant -->\r\n1.\r\n2.\r\n3.\r\n4.\r\n\r\n## Context\r\n<!--- How has this issue affected you? What are you trying to accomplish? -->\r\n<!--- Providing context helps us come up with a solution that is most useful in the real world -->\r\n- Security Vulnerability\r\n\r\n## Your Environment\r\n<!--- Include as many relevant details about the environment you experienced the bug in -->\r\n\r\n* Graylog Version: 2.4.3\r\n* Elasticsearch Version: 6.1.2\r\n* MongoDB Version: 3.6.2\r\n* Operating System: Mac OS High Seirra\r\n* Browser version: Firefox/Chrome"}}
{"actor":{"display_login":"bernd"}}