CVE-2020-10544: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 7, 2021

An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation.

References

github.com/advisories/GHSA-fw5f-7c6c-3vmv
github.com/primefaces/primefaces/issues/5642
nvd.nist.gov/vuln/detail/CVE-2020-10544

Code Behaviors & Features

Detect and mitigate CVE-2020-10544 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →