Description
An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation.
Remediation
References
https://github.com/primefaces/primefaces/issues/5642
Related Vulnerabilities
CVE-2019-15598 Vulnerability in npm package tree-kill
CVE-2016-5007 Vulnerability in maven package org.springframework:spring-webmvc
CVE-2021-33562 Vulnerability in maven package com.shopizer:shopizer
CVE-2021-23400 Vulnerability in npm package nodemailer
CVE-2021-21347 Vulnerability in maven package com.thoughtworks.xstream:xstream