CVE-2008-1285

Sun Java Server Faces <1.2_08 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

References (14)

[Vendor Advisory] http://rhn.redhat.com/errata/RHSA-2008-0825.html

[Vendor Advisory] http://rhn.redhat.com/errata/RHSA-2008-0826.html

[Vendor Advisory] http://rhn.redhat.com/errata/RHSA-2008-0827.html

[Vendor Advisory] http://rhn.redhat.com/errata/RHSA-2008-0828.html

[Patch] http://sunsolve.sun.com/search/document.do?assetkey=1-26-233561-1

[Vendor Advisory] http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp03/html-single/readme/index.html

[Vendor Advisory] http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.3.0.cp01/html-single/readme/

[Issue Tracking] https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=437082

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/41081

[Various Sources] https://jira.jboss.org/jira/browse/JBPAPP-682

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/28192

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id?1020628

[Third Party Advisory] http://secunia.com/advisories/29327

[Third Party Advisory] http://www.vupen.com/english/advisories/2008/0808/references

Scores

EPSS 0.0056

EPSS Percentile 67.9%

Classification

CWE

CWE-79

Status draft

Affected Products (2)

sun/jsf < 1.2_07

com.sun.faces/jsf-api < 1.2.08Maven

Timeline

Published Mar 11, 2008

Tracked Since Feb 18, 2026