CVE-2026-120421
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
62/100
Published: 2026-11-04
Modified: 2026-11-12
First seen: 2026-11-04
Status: active
Attack Surface
Network
Low Complexity
No Auth
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Required
S:
Changed
C:
Low
I:
Low
A:
None
Description
In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.
Weakness Classification (1)
Affected Software (6)
| Vendor | Product | Version |
|---|---|---|
| Eclipse Foundation | Eclipse Mojarra | 2.2.0 < 4.0.29 |
| Eclipse Foundation | Eclipse Mojarra | 4.1.0 < 4.1.20 |
| Eclipse Foundation | Eclipse Mojarra | 5.0.0-M1 < 5.0.0-M12 |
| Eclipse Foundation | Eclipse Mojarra | 2.2.0 < 4.0.29 |
| Eclipse Foundation | Eclipse Mojarra | 4.1.0 < 4.1.20 |
| Eclipse Foundation | Eclipse Mojarra | 5.0.0-M1 < 5.0.0-M12 |