PT-2020-12194 · Primetek · Primefaces

Dgusoft · Published 2020-03-13 · Updated 2021-05-07 · CVE-2020-10544

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PrimeFaces version 7.0.11

Description A cross-site scripting (XSS) issue was discovered in the tooltip/tooltip.js component of PrimeFaces. This issue allows an attacker to provide JavaScript code in an input field, which is later used as a tooltip title without any input validation, potentially leading to the execution of malicious scripts.

Recommendations For PrimeFaces version 7.0.11, consider validating all user input data used in tooltip titles to prevent the injection of malicious JavaScript code. As a temporary workaround, restrict the use of the tooltip feature until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-10544

GHSA-FW5F-7C6C-3VMV

Affected Products

Primefaces

References · 7

• https://osv.dev/vulnerability/GHSA-fw5f-7c6c-3vmv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10544 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10544 · Security Note
• https://github.com/primefaces/primefaces/issues/5642 · Note
• https://github.com/primefaces/primefaces · Note
• https://github.com/primefaces/primefaces/commit/9982c4f7a83f75e3ab06168fa283e3d6128dfd1f · Note
• https://t.me/cvenotify/1632 · Telegram Post