Non notée
CVE-2017-17837 The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling
Description
The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters (by default), so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache DeltaSpike | 1.8.0 | Pas de correctif indiqué |
Références
- issues.apache.org issues.apache.org
- git-wip-us.apache.org git-wip-us.apache.org
- [deltaspike-dev] 20210816 Another XSS vulnerability of the same type as CVE-2017-17837 lists.apache.org
- [deltaspike-dev] 20210818 Re: Another XSS vulnerability of the same type as CVE-2017-17837 lists.apache.org
Chronologie
- Publiée
- Dernière modification