Description
An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation.
Remediation
References
https://github.com/primefaces/primefaces/issues/5642
Related Vulnerabilities
CVE-2022-35915 Vulnerability in maven package org.webjars.npm:openzeppelin__contracts-upgradeable
CVE-2017-16151 Vulnerability in maven package org.webjars.npm:electron
CVE-2018-5673 Vulnerability in maven package org.webjars.bower:dojo
CVE-2020-2221 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2020-1719 Vulnerability in maven package org.wildfly.bom:wildfly