Cross-site Scripting in PrimeFaces

2021-05-0716:16:30

Google

osv.dev

0.001 Low

EPSS

Percentile

34.0%

JSON

An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation.

CPENameOperatorVersion
org.primefaces:primefaceseq7.0
org.primefaces:primefaceseq5.1
org.primefaces:primefaceseq4.0
org.primefaces:primefaceseq5.0
primefaceslt8.0
org.primefaces:primefaceseq5.2
org.primefaces:primefaceseq5.3
org.primefaces:primefaceseq6.0
org.primefaces:primefaceseq6.1
org.primefaces:primefaceseq6.2

Name	Operator	Version
org.primefaces:primefaces	eq	7.0
org.primefaces:primefaces	eq	5.1
org.primefaces:primefaces	eq	4.0
org.primefaces:primefaces	eq	5.0
primefaces	lt	8.0
org.primefaces:primefaces	eq	5.2
org.primefaces:primefaces	eq	5.3
org.primefaces:primefaces	eq	6.0
org.primefaces:primefaces	eq	6.1
org.primefaces:primefaces	eq	6.2