CVE-2013-5855: Cross-Site Scripting (XSS) in Mojarra
Summary
CVE-2013-5855: Improper Neutralization of Input During Web Page Generation in Mojarra. Affects org.glassfish:javax.faces across 2 version ranges.
>= 2.1.0, < 2.1.28
>= 2.2.0, < 2.2.6
Fixed in 2.1.28 or 2.2.6, depending on the release line you run. How to fix ↓
Also tracked for
- mojarra · Debian:11
The same CVE-2013-5855 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mojarra is a JavaServer Faces (JSF) implementation developed by Oracle. It provides a framework for building web applications using Java. Mojarra includes the javax.faces package, which is used for handling JSF components and related functionality. This vulnerability affects Mojarra versions 2.2.x before 2.2.6 and 2.1.x before 2.1.28. The vulnerability arises due to improper encoding when using the <h:outputText> tag or EL expressions after a script or style block. This allows remote attackers to conduct cross-site scripting (XSS) attacks by exploiting application-specific vectors.
Vulnerability Detail
The vulnerability in Mojarra allows an attacker to inject malicious scripts or HTML code into web pages generated by the application. This can lead to various consequences, including the theft of sensitive user information, session hijacking, defacement of web pages, and the execution of arbitrary code in the context of the victim's browser. The vulnerability is classified as CWE-79, which is the Common Weakness Enumeration identifier for Improper Neutralization of Input During Web Page Generation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.1.0, < 2.1.282.1.28 -
>= 2.2.0, < 2.2.62.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround can be implemented. This involves manually encoding the output of the <h:outputText> tag or EL expressions to prevent script injection. Developers can use appropriate encoding functions or libraries specific to their programming language or framework. It is important to ensure that all user-supplied input is properly encoded before being rendered in web pages.
Conclusion
The vulnerability in Mojarra allows for cross-site scripting (XSS) attacks, which can have serious consequences for web applications. It is crucial to upgrade to the fixed versions of Mojarra or implement the recommended workaround to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.glassfish:javax.faces →
FAQ
Mojarra is a JavaServer Faces (JSF) implementation developed by Oracle. It provides a framework for building web applications using Java.
Mojarra versions 2.2.x before 2.2.6 and 2.1.x before 2.1.28 are affected.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts or HTML code into web pages viewed by other users.
The vulnerability can lead to the theft of sensitive user information, session hijacking, defacement of web pages, and the execution of arbitrary code in the victim's browser.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.glassfish:javax.faces.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.