CVE-2007-3101
Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via the autoscroll parameter, which is injected into Javascript that is sent to…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 44.5%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via the autoscroll parameter, which is injected into Javascript that is sent to the client.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 44.45% probability · 99th percentile
- CISA KEV
- Not listed
- Affected
- apache/myfaces tomahawk
- Source
- secalert@redhat.com
References
- http://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12312536&styleName=Text&projectId=12310272
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=544
- http://osvdb.org/36377
- http://secunia.com/advisories/25618Vendor Advisory
- http://www.securityfocus.com/bid/24480Patch
- http://www.vupen.com/english/advisories/2007/2212
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34872
- http://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12312536&styleName=Text&projectId=12310272
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=544
- http://osvdb.org/36377
- http://secunia.com/advisories/25618Vendor Advisory
- http://www.securityfocus.com/bid/24480Patch
- http://www.vupen.com/english/advisories/2007/2212
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34872
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.