CVE-2007-3101

Apache MyFaces Tomahawk < 1.1.5 - Cross-Site Scripting via autoscroll Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2007-3101. PoCs published by Rajat Swarup.

AI-analyzed exploit summary The provided text describes a cross-site scripting (XSS) vulnerability in Apache Tomahawk MyFaces JSF Framework due to improper input sanitization. The exploit involves injecting JavaScript via the 'autoscroll' parameter in a URL.

Description

Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via the autoscroll parameter, which is injected into Javascript that is sent to the client.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Rajat Swarup · textwebappsjsp

https://www.exploit-db.com/exploits/30191

View Code ZIP pw:eip

The provided text describes a cross-site scripting (XSS) vulnerability in Apache Tomahawk MyFaces JSF Framework due to improper input sanitization. The exploit involves injecting JavaScript via the 'autoscroll' parameter in a URL.

Classification

Writeup 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Apache Tomahawk MyFaces JSF Framework

No auth needed

Prerequisites: A vulnerable version of Apache Tomahawk MyFaces JSF Framework · User interaction to visit a crafted URL

MITRE ATT&CK