NVD

Id
41085  
Name
CVE-2013-5855  
Description
Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-18  
Published
2014-07-17  
Modified Date
2016-12-30  
Seq
2013-5855  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
208042 41085 CVE-2013-5855 http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/ba-p/6368011#.U8ccVPlXZHU  View
208043 41085 CVE-2013-5855 RHSA-2015:0675  View
208044 41085 CVE-2013-5855 RHSA-2015:0720  View
208045 41085 CVE-2013-5855 RHSA-2015:0765  View
208046 41085 CVE-2013-5855 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities  View
208047 41085 CVE-2013-5855 http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html  View
208048 41085 CVE-2013-5855 http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html  View
208049 41085 CVE-2013-5855 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities  View
208050 41085 CVE-2013-5855 65600  View
208051 41085 CVE-2013-5855 http://www.vmware.com/security/advisories/VMSA-2014-0012.html  View
208052 41085 CVE-2013-5855 https://java.net/jira/browse/JAVASERVERFACES-3150  View
208053 41085 CVE-2013-5855 https://java.net/jira/browse/JAVASERVERFACES_SPEC_PUBLIC-1258  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
25041 JVNDB-2013-006616 Oracle Mojarra におけるクロスサイトスクリプティングの脆弱性 Oracle Mojarra は、スクリプタスタイルのブロック後に (1) tag または (2) EL エクスプレッションが使用されている場合、適切なエンコードを実行しないため、クロスサイトスクリプティング (XSS) 攻撃を実行される脆弱性が存在します。 CVE-2013-5855 65797 CVE-2013-5855 41085 4.3 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-006616.html 2013-09-18 2016-01-29 View