https://bugzilla.redhat.com/show_bug.cgi?id=1532122
Bug ID: 1532122
Summary: CVE-2017-17837 Apache DeltaSpike: XSS injection
vulnerability in windowId handling
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: aileenc(a)redhat.com, chazlett(a)redhat.com,
gvarsami(a)redhat.com, hchiorea(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jolee(a)redhat.com,
jstastny(a)redhat.com, kconner(a)redhat.com,
ldimaggi(a)redhat.com, lef(a)fedoraproject.org,
nwallace(a)redhat.com, pavelp(a)redhat.com,
puntogil(a)libero.it, rwagner(a)redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com,
vhalbert(a)redhat.com
The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId
handling. The default size of the windowId get's cut off after 10 characters
(by default), so the impact might be limited. A fix got applied and released in
Apache deltaspike-1.8.1.
References:
https://nvd.nist.gov/vuln/detail/CVE-2017-17837
https://issues.apache.org/jira/browse/DELTASPIKE-1307
https://git-wip-us.apache.org/repos/asf?p=deltaspike.git;h=4e25023
--
You are receiving this mail because:
You are on the CC list for the bug.