CVE-2007-3101

Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via the autoscroll parameter, which is injected into Javascript that is sent to the client.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=544
http://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12312536&styleName=Text&projectId=12310272
http://www.securityfocus.com/bid/24480	Patch
http://secunia.com/advisories/25618	Vendor Advisory
http://www.vupen.com/english/advisories/2007/2212
http://osvdb.org/36377
https://exchange.xforce.ibmcloud.com/vulnerabilities/34872

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:myfaces_tomahawk:*:*:*:*:*:*:*:*

Information

Published : 2007-06-18 03:30

Updated : 2017-07-28 18:31

NVD link : CVE-2007-3101

Mitre link : CVE-2007-3101

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

apache

myfaces_tomahawk

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=544", "name": "20070614 Apache MyFaces Tomahawk JSF Framework Cross-Site Scripting (XSS) Vulnerability", "tags": [], "refsource": "IDEFENSE"}, {"url": "http://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12312536&styleName=Text&projectId=12310272", "name": "http://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12312536&styleName=Text&projectId=12310272", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/24480", "name": "24480", "tags": ["Patch"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/25618", "name": "25618", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.vupen.com/english/advisories/2007/2212", "name": "ADV-2007-2212", "tags": [], "refsource": "VUPEN"}, {"url": "http://osvdb.org/36377", "name": "36377", "tags": [], "refsource": "OSVDB"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34872", "name": "myfaces-autoscroll-xss(34872)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via the autoscroll parameter, which is injected into Javascript that is sent to the client."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-3101", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2007-06-18T10:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:apache:myfaces_tomahawk:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.1.5"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-29T01:31Z"}