GitHub Advisoryadvisory · Maven

GHSA-3m3r-82gc-53mj Improper Neutralization of Input During Web Page Generation in Mojarra

MEDIUM Published 2022-05-14 Modified 2022-07-07 Official page ↗
Aliases
CVE-2013-5855
Ecosystem
Maven
Packages
org.glassfish:javax.faces
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2022-07-07

Affected packages

• Maven org.glassfish:javax.faces: >= 2.2.0, < 2.2.6 → fixed in 2.2.6 • Maven org.glassfish:javax.faces: >= 2.1.0, < 2.1.28 → fixed in 2.1.28

Description

Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.

Related

Alias · CVE (1)

  • CVE-2013-5855 Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References