CVE-2013-5855
En bref
- Source
- NVD
- EPSS
- EPSS 4.71 % · centile 92 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- oracle
- Statut NVD
- Modified
Description
Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.
Faiblesses (CWE)
- CWE-79 — Injection de code indirecte (XSS)
Références
- http://rhn.redhat.com/errata/RHSA-2015-0765.html
- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/ba-p/6368011#.U8ccVPlXZHU
- http://rhn.redhat.com/errata/RHSA-2015-0675.html
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- http://rhn.redhat.com/errata/RHSA-2015-0720.html
- http://www.securityfocus.com/bid/65600
- https://java.net/jira/browse/JAVASERVERFACES_SPEC_PUBLIC-1258
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- http://www.securityfocus.com/archive/1/534161/100/0/threaded
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- https://java.net/jira/browse/JAVASERVERFACES-3150
- http://seclists.org/fulldisclosure/2014/Dec/23
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-3m3r-82gc-53mj — Improper Neutralization of Input During Web Page Generation in Mojarra
Références européennes
- ENISA EUVD · EUVD-2022-2207
- GCVE · GCVE-0-2013-5855
Avis du CERT-FR
- CERTFR-2014-AVI-313 — Multiples vulnérabilités dans Oracle Fusion Middleware · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:oracle:mojarra:2.1.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.5:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.6:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.7:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.8:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.9:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.10:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.11:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.12:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.13:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.14:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.15:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.16:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.17:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.18:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.19:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.20:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.21:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.22:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.23:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.24:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.25:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.26:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.1.27:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.2.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.2.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.2.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.2.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.2.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:mojarra:2.2.5:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |