QwikSec

Security Database

CVE

CWE

Training

CVE-2013-5855

Published: Jul 17, 2014

Modified: Aug 6, 2024

PUBLISHED

Description

Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

vendor-advisory

x_refsource_REDHAT

http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/ba-p/6368011#.U8ccVPlXZHU

x_refsource_MISC

vendor-advisory

x_refsource_REDHAT

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

x_refsource_CONFIRM

vendor-advisory

x_refsource_REDHAT

vdb-entry

x_refsource_BID

https://java.net/jira/browse/JAVASERVERFACES_SPEC_PUBLIC-1258

x_refsource_CONFIRM

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

x_refsource_CONFIRM

20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

mailing-list

x_refsource_BUGTRAQ

http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html

x_refsource_CONFIRM

https://java.net/jira/browse/JAVASERVERFACES-3150

x_refsource_CONFIRM

20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities

mailing-list

x_refsource_FULLDISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.