XSS Vulnerability in Apache DeltaSpike-JSF Affects WindowId Handling
CVE-2017-17837

6.1MEDIUM

Key Information:

Vendor: Apache
Status: Apache Deltaspike
Vendor: CVE Published:; 4 January 2018

What is CVE-2017-17837?

A Cross-Site Scripting (XSS) vulnerability exists in the Apache DeltaSpike-JSF module version 1.8.0 due to improper handling of the windowId. The default behavior truncates the windowId to 10 characters, which may limit the impact but still exposes the application to potential XSS attacks. This issue has been addressed and mitigated in version 1.8.1, highlighting the importance of keeping software up to date to protect against such vulnerabilities.