{"containers":{"cna":{"affected":[{"product":"Apache DeltaSpike","vendor":"Apache Software Foundation","versions":[{"status":"affected","version":"1.8.0"}]}],"datePublic":"2018-01-04T00:00:00.000Z","descriptions":[{"lang":"en","value":"The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters (by default), so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1."}],"problemTypes":[{"descriptions":[{"description":"Information Disclosure","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2021-08-18T16:06:12.000Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://issues.apache.org/jira/browse/DELTASPIKE-1307"},{"tags":["x_refsource_CONFIRM"],"url":"https://git-wip-us.apache.org/repos/asf?p=deltaspike.git%3Bh=4e25023"},{"name":"[deltaspike-dev] 20210816 Another XSS vulnerability of the same type as CVE-2017-17837","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.apache.org/thread.html/r78565f0f4ecb4ad32a6c405b45b9ee568dfc4729ba63e7d7cb6adf88%40%3Cdev.deltaspike.apache.org%3E"},{"name":"[deltaspike-dev] 20210818 Re: Another XSS vulnerability of the same type as CVE-2017-17837","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.apache.org/thread.html/r17b326c0eb35d8c71c84c171eda83e3e1f011dc757781e34f2846018%40%3Cdev.deltaspike.apache.org%3E"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@apache.org","DATE_PUBLIC":"2018-01-04T00:00:00","ID":"CVE-2017-17837","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Apache DeltaSpike","version":{"version_data":[{"version_value":"1.8.0"}]}}]},"vendor_name":"Apache Software Foundation"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters (by default), so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Information Disclosure"}]}]},"references":{"reference_data":[{"name":"https://issues.apache.org/jira/browse/DELTASPIKE-1307","refsource":"CONFIRM","url":"https://issues.apache.org/jira/browse/DELTASPIKE-1307"},{"name":"https://git-wip-us.apache.org/repos/asf?p=deltaspike.git;h=4e25023","refsource":"CONFIRM","url":"https://git-wip-us.apache.org/repos/asf?p=deltaspike.git;h=4e25023"},{"name":"[deltaspike-dev] 20210816 Another XSS vulnerability of the same type as CVE-2017-17837","refsource":"MLIST","url":"https://lists.apache.org/thread.html/r78565f0f4ecb4ad32a6c405b45b9ee568dfc4729ba63e7d7cb6adf88@%3Cdev.deltaspike.apache.org%3E"},{"name":"[deltaspike-dev] 20210818 Re: Another XSS vulnerability of the same type as CVE-2017-17837","refsource":"MLIST","url":"https://lists.apache.org/thread.html/r17b326c0eb35d8c71c84c171eda83e3e1f011dc757781e34f2846018@%3Cdev.deltaspike.apache.org%3E"}]}}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T21:06:48.991Z"},"title":"CVE Program Container","references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://issues.apache.org/jira/browse/DELTASPIKE-1307"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://git-wip-us.apache.org/repos/asf?p=deltaspike.git%3Bh=4e25023"},{"name":"[deltaspike-dev] 20210816 Another XSS vulnerability of the same type as CVE-2017-17837","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.apache.org/thread.html/r78565f0f4ecb4ad32a6c405b45b9ee568dfc4729ba63e7d7cb6adf88%40%3Cdev.deltaspike.apache.org%3E"},{"name":"[deltaspike-dev] 20210818 Re: Another XSS vulnerability of the same type as CVE-2017-17837","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.apache.org/thread.html/r17b326c0eb35d8c71c84c171eda83e3e1f011dc757781e34f2846018%40%3Cdev.deltaspike.apache.org%3E"}]}]},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2017-17837","datePublished":"2018-01-04T15:00:00.000Z","dateReserved":"2017-12-22T00:00:00.000Z","dateUpdated":"2024-09-17T02:21:15.482Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"}