CVE-2026-120421

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120421", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2026-11-02T12:27:27.406Z", "datePublished": "2026-11-04T15:12:11.190Z", "dateUpdated": "2026-11-04T20:00:57.838Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-11-04T15:12:11.190Z"}, "title": "Reflected XSS via client window id in URL client window mode", "datePublic": "2026-11-04T15:09:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "affected": [{"vendor": "Eclipse Foundation", "product": "Eclipse Mojarra", "versions": [{"status": "affected", "version": "2.2.0", "lessThan": "4.0.29", "versionType": "semver"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.20", "versionType": "semver"}, {"status": "affected", "version": "5.0.0-M1", "lessThan": "5.0.0-M12", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.</p>"}]}], "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/536"}, {"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1332"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "credits": [{"lang": "en", "value": "Christian Munier", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-120421", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T18:18:42.408189Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T20:00:57.838Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-120421", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T18:18:42.408189Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T19:59:28.587Z"}}], "cna": {"title": "Reflected XSS via client window id in URL client window mode", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Christian Munier"}], "impacts": [{"capecId": "CAPEC-591", "descriptions": [{"lang": "en", "value": "CAPEC-591 Reflected XSS"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Eclipse Foundation", "product": "Eclipse Mojarra", "versions": [{"status": "affected", "version": "2.2.0", "lessThan": "4.0.29", "versionType": "semver"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.20", "versionType": "semver"}, {"status": "affected", "version": "5.0.0-M1", "lessThan": "5.0.0-M12", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-11-04T15:09:00.000Z", "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/536"}, {"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1332"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.", "supportingMedia": [{"type": "text/html", "value": "<p>In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-11-04T15:12:11.190Z"}}}, "cveMetadata": {"cveId": "CVE-2026-120421", "state": "PUBLISHED", "dateUpdated": "2026-11-04T20:00:57.838Z", "dateReserved": "2026-11-02T12:27:27.406Z", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "datePublished": "2026-11-04T15:12:11.190Z", "assignerShortName": "eclipse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Eclipse Mojarra", "vendor": "Eclipse Foundation", "versions": [{"lessThan": "4.0.29", "status": "affected", "version": "2.2.0", "versionType": "semver"}, {"lessThan": "4.1.20", "status": "affected", "version": "4.1.0", "versionType": "semver"}, {"lessThan": "5.0.0-M12", "status": "affected", "version": "5.0.0-M1", "versionType": "semver"}]}], "source": "emo@eclipse.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy."}], "id": "CVE-2026-120421", "lastModified": "2026-11-12T18:43:27.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "emo@eclipse.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-120421", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T18:18:42.408189Z", "version": "2.0.3"}}]}, "published": "2026-11-04T15:17:41.590", "references": [{"source": "emo@eclipse.org", "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/536"}, {"source": "emo@eclipse.org", "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1332"}], "sourceIdentifier": "emo@eclipse.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "emo@eclipse.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.glassfish/jakarta.faces: Eclipse Mojarra: Reflected cross-site scripting via unencoded client window parameter", "id": "2567021", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567021"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.", "A flaw was found in Eclipse Mojarra. When URL client window mode is enabled, the client window identifier parameter is appended to generated URLs without proper encoding. A remote attacker could exploit this by enticing a user to follow a malicious link, leading to reflected Cross-Site Scripting (XSS). This flaw allows the attacker to execute arbitrary scripts in the victim's browser session and potentially bypass Content Security Policy (CSP) protections."], "mitigation": {"lang": "en:us", "value": "Keep jakarta.faces.CLIENT_WINDOW_MODE at its default value (none) rather than url, and avoid rendering client-window-bearing URLs via h:button with an outcome. Note that enabling com.sun.faces.enableCspNonce=true does not mitigate this flaw and instead allows the injected script to run on page load inside the nonce script element, bypassing CSP."}, "name": "CVE-2026-120421", "package_state": [{"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Out of support scope", "package_name": "jakarta.faces", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "jakarta.faces", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "jakarta.faces", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}], "public_date": "2026-11-04T15:12:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-120421\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-120421\nhttps://gitlab.eclipse.org/security/cve-assignment/-/work_items/536\nhttps://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1332"], "statement": "A reflected cross-site scripting (XSS) flaw was found in Eclipse Mojarra. When URL client window mode is enabled (jakarta.faces.CLIENT_WINDOW_MODE=url), the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs without URL-encoding, and h:button renders such a URL into a JavaScript string literal, allowing reflected XSS. With com.sun.faces.enableCspNonce=true, the injected script runs on page load inside the nonce script element, bypassing Content Security Policy. Red Hat ships org.glassfish/jakarta.faces 2.3.14.redhat-00001 in eap-7.4.z and 4.0.11.redhat-00001 in eap-8.1.z and eapxp-6, all within the affected ranges (introduced 2.2.0; fixed upstream in 4.0.29, 4.1.20, and 5.0.0-M12).", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.2.0,4.0.29)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.1.0,4.1.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0-M1,5.0.0-M12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Eclipse Mojarra", "source": "cna", "vendor": "Eclipse Foundation"}, "product": "eclipse_mojarra", "vendor": "eclipse"}], "created": "2026-11-04T17:00:15.281906+00:00", "updated": "2026-11-04T17:15:14.806232+00:00", "vendors": ["eclipse", "eclipse$PRODUCT$eclipse_mojarra"]}