-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.glassfish:javax.faces | maven | < 2.2.20 | 2.2.20 |
| org.glassfish:jakarta.faces | maven | < 2.3.10 | 2.3.10 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of the client window field in PartialViewContextImpl.java. The commit diff shows the fix changed from writer.write(window.getId()) to writer.writeText(window.getId(), null). This indicates the original implementation used raw output writing without proper XSS protections. The writeText() method handles HTML encoding, while write() does not. The client window parameter was user-controllable input reflected in responses without sanitization, meeting the criteria for CWE-79 XSS.
KEV Misses 88% of Exploited CVEs- Get the report