CVE-2007-3101

Published: Jun 18, 2007Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via the autoscroll parameter, which is injected into Javascript that is sent to the client.

Affected (1)

Products: Apache: Myfaces Tomahawk

1 product

Myfaces Tomahawk

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Myfaces Tomahawk	Up to 1.1.5

References (14)

http://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12312536&styleName=Text&projectId=12310272

Source: secalert@redhat.com

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=544

Source: secalert@redhat.com

http://osvdb.org/36377

Source: secalert@redhat.com

http://secunia.com/advisories/25618

Source: secalert@redhat.com

Vendor Advisory

http://www.securityfocus.com/bid/24480

Source: secalert@redhat.com

Patch

http://www.vupen.com/english/advisories/2007/2212

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/34872

Source: secalert@redhat.com

http://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12312536&styleName=Text&projectId=12310272

Source: af854a3a-2127-422b-91ae-364da2661108

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=544

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/36377

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/25618

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/24480

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.vupen.com/english/advisories/2007/2212

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/34872

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.