Description
An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation.
Remediation
References
https://github.com/primefaces/primefaces/issues/5642
Related Vulnerabilities
CVE-2021-44228 Vulnerability in maven package org.apache.logging.log4j:log4j-core
CVE-2010-2076 Vulnerability in maven package org.apache.cxf:cxf-bundle-jaxrs
CVE-2016-10644 Vulnerability in npm package slimerjs-edge
CVE-2021-39157 Vulnerability in npm package detect-character-encoding
CVE-2018-7408 Vulnerability in maven package org.webjars.bower:npm