CVE-2019-12416: Injection in DeltaSpike
Summary
CVE-2019-12416: Injection in DeltaSpike. Affects org.apache.deltaspike:deltaspike versions < 1.9.4. Fixed in 1.9.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
DeltaSpike is a Maven package that provides a set of portable CDI (Contexts and Dependency Injection) extensions. It offers additional functionality and simplifies the development of Java EE applications. The DeltaSpike windowhandler.js is a component that handles window-related operations. The ClientSideWindowStrategy, although not the default, can be selected by developers. This vulnerability affects versions up to 1.9.3.
Vulnerability Detail
The vulnerability involves two injection attacks against the DeltaSpike windowhandler.js. These attacks are only active if the developer has chosen the ClientSideWindowStrategy. The injection attacks can lead to unauthorized access, data manipulation, or other malicious activities. The severity of this vulnerability is moderate, with a CVSS score of 6.1.
How To Fix
Minimum fixed version
1.9.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the DeltaSpike package is not immediately feasible, a temporary workaround is to avoid using the ClientSideWindowStrategy and switch to the default WindowStrategy. This can be done by modifying the configuration or code that selects the window strategy.
Conclusion
The DeltaSpike package is vulnerable to injection attacks in the windowhandler.js component when the ClientSideWindowStrategy is selected. It is crucial to update to version 1.9.4 or later to mitigate this vulnerability. If immediate update is not possible, switching to the default WindowStrategy can serve as a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.deltaspike:deltaspike →
FAQ
DeltaSpike is a Maven package that provides CDI extensions for Java EE applications.
The DeltaSpike windowhandler.js is responsible for handling window-related operations in DeltaSpike applications.
The ClientSideWindowStrategy is an optional strategy in DeltaSpike that developers can choose for window handling.
The injection attacks can lead to unauthorized access, data manipulation, or other malicious activities.
The severity of this vulnerability is moderate, with a CVSS score of 6.1.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
