~ / search / GHSA-3m3r-82gc-53mj

GHSA-3m3r-82gc-53mj

Improper Neutralization of Input During Web Page Generation in Mojarra

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-5855

Packages

EcosystemPackageAffectedFixed in
Maven org.glassfish:javax.faces >= 2.2.0, < 2.2.6 2.2.6
Maven org.glassfish:javax.faces >= 2.1.0, < 2.1.28 2.1.28

Details

As written in the advisory (Markdown source, shown as plain text).

Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.

References

External links from the advisory. They lead to third-party sites.