CVE-2017-17837

The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling

published January 4, 2018

CVSS
—
EPSS
4%
Percentile
91.4
In the wild
Unconfirmed
What it is

The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters (by default), so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04471 · 91.4th percentile
Published
2018-01-04T15:00Z
EPSS history
Timeline
  • 04 JAN 15:00Z
    The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling
    cvelistv5