Description
The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters (by default), so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache DeltaSpike | 1.8.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.deltaspike.modules:jsf-module-project | < 1.8.1 | 1.8.1 | GHSA-4q23-g7mf-xp98 |
References
- https://issues.apache.org/jira/browse/DELTASPIKE-1307
- https://git-wip-us.apache.org/repos/asf?p=deltaspike.git%3Bh=4e25023
- [deltaspike-dev] 20210816 Another XSS vulnerability of the same type as CVE-2017-17837 mailing-list
- [deltaspike-dev] 20210818 Re: Another XSS vulnerability of the same type as CVE-2017-17837 mailing-list