Not rated
CVE-2017-17837 The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling
Description
The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters (by default), so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache DeltaSpike | 1.8.0 | No fix stated |
References
- issues.apache.org issues.apache.org
- git-wip-us.apache.org git-wip-us.apache.org
- [deltaspike-dev] 20210816 Another XSS vulnerability of the same type as CVE-2017-17837 lists.apache.org
- [deltaspike-dev] 20210818 Re: Another XSS vulnerability of the same type as CVE-2017-17837 lists.apache.org
Timeline
- Published
- Last modified