cve.bz

CVE-2017-17837

6.1 mediumEPSS 4.5%

Medium (6.1) in apache deltaspike. EPSS 4.5% chance of exploitation in the next 30 days. Fixed in org.apache.deltaspike.modules:jsf-module-project 1.8.1.

The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters (by default), so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1.

Severity

CVSS 3.1

6.1 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
4.5% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-4q23-g7mf-xp98Mavenorg.apache.deltaspike.modules:jsf-module-project<1.8.11.8.1

References

Check your stackJSON