MEDIUM6.1

GHSA-fw5f-7c6c-3vmv

Cross-site Scripting in PrimeFaces

Quick fix

GHSA-fw5f-7c6c-3vmv — primefaces: upgrade to the fixed version with the command below.

npm install primefaces@8.0

Details

An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/primefaces

Introduced in: 0Fixed in: 8.0

Fixnpm install primefaces@8.0

Maven/org.primefaces:primefaces

Introduced in: 0Fixed in: 8.0

Fix# pom.xml: bump <version>8.0</version> for org.primefaces:primefaces

References

https://nvd.nist.gov/vuln/detail/CVE-2020-10544[ADVISORY]
https://github.com/primefaces/primefaces/issues/5642[WEB]
https://github.com/primefaces/primefaces/commit/9982c4f7a83f75e3ab06168fa283e3d6128dfd1f[WEB]
https://github.com/primefaces/primefaces[PACKAGE]