CVE-2013-5855

Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used…

published July 17, 2014

CVSS
—
EPSS
5%
Percentile
91.8
In the wild
Unconfirmed
What it is

Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04715 · 91.8th percentile
Published
2014-07-17T02:36Z
EPSS history
Timeline
  • 17 JUL 02:36Z
    Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used…
    cvelistv5