CVEvulnerability

CVE-2013-5855

4.3 MEDIUM Published 2014-07-17 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2014-07-17
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.

Affected configurations

• oracle mojarra 2.1.0 • oracle mojarra 2.1.1 • oracle mojarra 2.1.2 • oracle mojarra 2.1.3 • oracle mojarra 2.1.4 • oracle mojarra 2.1.5 • oracle mojarra 2.1.6 • oracle mojarra 2.1.7 • oracle mojarra 2.1.8 • oracle mojarra 2.1.9 • oracle mojarra 2.1.10 • oracle mojarra 2.1.11 • oracle mojarra 2.1.12 • oracle mojarra 2.1.13 • oracle mojarra 2.1.14 • oracle mojarra 2.1.15 • oracle mojarra 2.1.16 • oracle mojarra 2.1.17 • oracle mojarra 2.1.18 • oracle mojarra 2.1.19 • oracle mojarra 2.1.20 • oracle mojarra 2.1.21 • oracle mojarra 2.1.22 • oracle mojarra 2.1.23 • oracle mojarra 2.1.24 • oracle mojarra 2.1.25 • oracle mojarra 2.1.26 • oracle mojarra 2.1.27 • oracle mojarra 2.2.0 • oracle mojarra 2.2.1 • oracle mojarra 2.2.2 • oracle mojarra 2.2.3 • oracle mojarra 2.2.4 • oracle mojarra 2.2.5

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References