CVE-2017-17837 Cross-site Scripting in Apache DeltaSpike
MediumCVSS 6.1
EPSS 4.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters (by default), so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.deltaspike.modules/jsf-module-project(Maven) | < 1.8.1 | 1.8.1 |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 0.4 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 0.5 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 0.6 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 0.7 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.0.0 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.0.1 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.0.2 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.0.3 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.1.0 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.2.0 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.2.1 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.3.0 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.4.0 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.4.1 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.4.2 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.5.0 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.5.1 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.5.2 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.5.3 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.5.4 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.6.0 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.6.1 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.7.0 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.7.1 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.7.2 | No fix listed |
| org.apache.deltaspike.modules/jsf-module-project(Maven) | = 1.8.0 | No fix listed |
| apache deltaspike | = 1.8.0 | No fix listed |
| Apache DeltaSpike | = 1.8.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- git-wip-us.apache.org
- issues.apache.org exploit issue-tracking patch vendor-advisory
- lists.apache.org
- lists.apache.org
- github.com patch
- github.com
- git-wip-us.apache.org
- [deltaspike-dev] 20210818 Re: Another XSS vulnerability of the same type as CVE-2017-17837 mailing-list
- [deltaspike-dev] 20210816 Another XSS vulnerability of the same type as CVE-2017-17837 mailing-list