Question
Cognizant
GB
Last activity: 6 Jul 2023 9:43 EDT
CAD-17193 : Cross Scripting Vulnerability Fix - Testing required
As part of our project, we are looking to incorporate the fix for Cross Scripting Vulnerability. In order to take it Live, we would like to test and establish there is no implications to any of the impacted areas that uses "pyPostTextParser" activity where the change is being made.
Currently, we have tested the Pulse functionality and can see this is working as expected, is there any other areas that need to be tested before publishing the changes Live ?
Attached is the email we have received and are referencing to.
Sun Life
CA
We tested the fix from one of our application that has comment feature. We injected a cross-site script in the comment and when the application responded back, it encoded the html tags - is this the fix? However, when we checked our database, the cross-site script was saved "as is". We want the encoded data to be saved to the database as well. Please advise.
Sun Life
CA
In PEGA, these two parameters -> $PpxRequestor$ppyLattitude and $PpxRequestor$ppyLongitude is susceptible against XSS reflected attack.
Please advise if A23 fix can able to resolved this.