CVE-2013-5855: XSS
It was found that Mojarra JSF would not properly escape user-supplied content in certain circumstances. The contents of outputText tags and raw EL expressions that immediately follow <script> or <style> elements were not escaped. If a remote attacker could trick a user into visiting a specially-crafted URL, it would lead to arbitrary web script execution in the user's browser.
Other sources
Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5855?
The severity of CVE-2013-5855 is considered medium due to its potential exploitation through cross-site scripting (XSS).
How do I fix CVE-2013-5855?
To fix CVE-2013-5855, upgrade Mojarra JSF to versions 2.2.0 or later where the issue has been addressed.
Which versions of Mojarra JSF are affected by CVE-2013-5855?
CVE-2013-5855 affects Mojarra JSF versions 2.1.0 through 2.1.27.
What actions can I take if I cannot upgrade from Mojarra JSF impacted by CVE-2013-5855?
If upgrading is not possible, consider implementing input sanitization and output encoding to mitigate the risk of XSS attacks.
How does CVE-2013-5855 affect web applications?
CVE-2013-5855 can allow attackers to inject malicious scripts, compromising the security of web applications and exposing user data.