Skip to content
Fencer Vulns
medium 5.3

CVE-2008-1285 json

Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF)

published 2008-03-11 18 y ago modified 2026-06-16 4 mo ago also GHSA-vv6j-5x58-q2c3 , EUVD-2022-5430

cvss
5.3
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
2.5%
EPSS 2.5% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

Patch / fix

  • maven com.sun.faces:jsf-api 1.2.08
  • asm jboss enterprise application platform 4.3.0 1.5.3-1jpp.ep1.2.el5
  • cglib jboss enterprise application platform 4.3.0 2.1.3-2jpp.ep1.6.el5
  • jbossas jboss enterprise application platform 4.3.0 4.3.0-2.GA_CP01.ep1.6.el5.1
  • jbossts jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1:4.2.3-1.SP5_CP01.1jpp.ep1.1.el5
  • jbossws jboss enterprise application platform 4.3.0 2.0.1-2.SP2_CP01.0jpp.ep1.2.el5
  • jbossxb jboss enterprise application platform 4.3.0 1.0.0-2.SP1.0jpp.ep1.2.el5.1
  • jcommon jboss enterprise application platform 4.3.0, jboss enterprise application platform 4.2.0 1.0.12-1jpp.ep1.3.el5
  • jgroups jboss enterprise application platform 4.3.0 1:2.4.2-1.GA_CP01.0jpp.ep1.1.el5

red hat advisories RHSA-2008:0828RHSA-2008:0827RHSA-2008:0826RHSA-2008:0825

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2008-1285 updated

Cross-site scripting (XSS) vulnerability in Sun Java Server Faces

  • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS jboss-seam 1.2.1-1.ep1.7.el4, jcommon 1.0.12-1jpp.ep1.3.el4, jfreechart 1.0.9-1jpp.ep1.3.el4, jbossas 4.2.0-3.GA_CP03.ep1.9.el4, jboss-cache 1.4.1-4.SP9.1jpp.ep1.1.el4, glassfish-javamail 1.4.0-0jpp.ep1.9.el4, +7 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES jboss-seam 1.2.1-1.ep1.7.el4, jcommon 1.0.12-1jpp.ep1.3.el4, jfreechart 1.0.9-1jpp.ep1.3.el4, jbossas 4.2.0-3.GA_CP03.ep1.9.el4, jboss-cache 1.4.1-4.SP9.1jpp.ep1.1.el4, glassfish-javamail 1.4.0-0jpp.ep1.9.el4, +7 more
    fixed: vendor fix RHSA-2008:0825
  • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server jboss-seam 1.2.1-1.ep1.6.el5, jcommon 1.0.12-1jpp.ep1.3.el5, jfreechart 1.0.9-1jpp.ep1.3.el5.1, jbossas 4.2.0-4.GA_CP03.ep1.8.el5.1, jboss-cache 1.4.1-4.SP9.1jpp.ep1.1.el5, jbossts 4.2.3-1.SP5_CP01.1jpp.ep1.1.el5, +6 more
    fixed: vendor fix RHSA-2008:0827
  • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS jcommon 1.0.12-1jpp.ep1.3.el4, jfreechart 1.0.9-1jpp.ep1.3.el4, jbossas 4.3.0-2.GA_CP01.ep1.7.el4, jboss-aop 1.5.5-1.CP01.0jpp.ep1.1.el4, jboss-cache 1.4.1-4.SP9.1jpp.ep1.1.el4, jgroups 2.4.2-1.GA_CP01.0jpp.ep1.1.el4, +11 more Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES jcommon 1.0.12-1jpp.ep1.3.el4, jfreechart 1.0.9-1jpp.ep1.3.el4, jbossas 4.3.0-2.GA_CP01.ep1.7.el4, jboss-aop 1.5.5-1.CP01.0jpp.ep1.1.el4, jboss-cache 1.4.1-4.SP9.1jpp.ep1.1.el4, jgroups 2.4.2-1.GA_CP01.0jpp.ep1.1.el4, +11 more
    fixed: vendor fix RHSA-2008:0826
  • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server asm 1.5.3-1jpp.ep1.2.el5, cglib 2.1.3-2jpp.ep1.6.el5, jcommon 1.0.12-1jpp.ep1.3.el5, concurrent 1.3.4-8jpp.ep1.6.el5.1, jfreechart 1.0.9-1jpp.ep1.3.el5.1, glassfish-jsf 1.2_08-0jpp.ep1.2.el5, +16 more
    fixed: vendor fix RHSA-2008:0828
  • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS asm 1.5.3-1jpp.ep1.2.el4, cglib 2.1.3-2jpp.ep1.6.el4, glassfish-jaf 1.1.0-0jpp.ep1.11.el4, glassfish-jsf 1.2_08-0jpp.ep1.1.el4, jbossws-jboss42 1.2.1-0jpp.ep1.4.el4, jgroups 2.4.2-1.GA_CP01.0jpp.ep1.1.el4, +2 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES asm 1.5.3-1jpp.ep1.2.el4, cglib 2.1.3-2jpp.ep1.6.el4, glassfish-jaf 1.1.0-0jpp.ep1.11.el4, glassfish-jsf 1.2_08-0jpp.ep1.1.el4, jbossws-jboss42 1.2.1-0jpp.ep1.4.el4, jgroups 2.4.2-1.GA_CP01.0jpp.ep1.1.el4, +2 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server asm 1.5.3-1jpp.ep1.2.el5, cglib 2.1.3-2jpp.ep1.6.el5, glassfish-jsf 1.2_08-0jpp.ep1.2.el5, glassfish-jaf 1.1.0-0jpp.ep1.11.el5.1, jbossws-jboss42 1.2.1-0jpp.ep1.4.el5.1, jgroups 2.4.2-1.GA_CP01.0jpp.ep1.1.el5, +3 more Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS asm 1.5.3-1jpp.ep1.2.el4, cglib 2.1.3-2jpp.ep1.6.el4, concurrent 1.3.4-7jpp.ep1.6.el4, jbossxb 1.0.0-2.SP1.0jpp.ep1.2.el4, glassfish-jaf 1.1.0-0jpp.ep1.11.el4, glassfish-jsf 1.2_08-0jpp.ep1.1.el4, +2 more Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES asm 1.5.3-1jpp.ep1.2.el4, cglib 2.1.3-2jpp.ep1.6.el4, concurrent 1.3.4-7jpp.ep1.6.el4, jbossxb 1.0.0-2.SP1.0jpp.ep1.2.el4, glassfish-jaf 1.1.0-0jpp.ep1.11.el4, glassfish-jsf 1.2_08-0jpp.ep1.1.el4, +2 more Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server glassfish-jaf 1.1.0-0jpp.ep1.11.el5.1, glassfish-javamail 1.4.0-0jpp.ep1.9.el5
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.54% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven com.sun.faces:jsf-api
<1.2.08
1.2.08

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.