{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the RichFaces component in Red Hat JBoss Portal 6.1.1, which resolves one security issue, is now available from the Red Hat Customer\nPortal.\n\nRed Hat Product Security has rated this update as having Moderate security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Portal is the open source implementation of the Java EE suite\nof services and Portal services running atop Red Hat JBoss Enterprise\nApplication Platform. It comprises a set of offerings for enterprise\ncustomers who are looking for pre-configured profiles of JBoss Middleware\ncomponents that have been tested and certified together to provide an\nintegrated experience.\n\nRichFaces is an open source framework that adds Ajax capability into\nexisting JavaServer Faces (JSF) applications.\n\nIt was found that RichFaces accepted arbitrary strings included in a URL\nand returned them unencoded in a CSS file. A remote attacker could use this\nflaw to perform cross-site scripting (XSS) attacks against a user running a\nRichFaces application. (CVE-2014-7852)\n\nAll users of Red Hat JBoss Portal 6.1.1 as provided from the Red Hat\nCustomer Portal are advised to install this update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:1973",
        "url": "https://access.redhat.com/errata/RHSA-2014:1973"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal\u0026downloadType=securityPatches\u0026version=6.1.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jbportal\u0026downloadType=securityPatches\u0026version=6.1.1"
      },
      {
        "category": "external",
        "summary": "1164024",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1164024"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1973.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Portal 6.1.1 security update",
    "tracking": {
      "current_release_date": "2024-11-22T08:45:36+00:00",
      "generator": {
        "date": "2024-11-22T08:45:36+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2014:1973",
      "initial_release_date": "2014-12-09T17:56:38+00:00",
      "revision_history": [
        {
          "date": "2014-12-09T17:56:38+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:34:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T08:45:36+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Portal Platform 6.1",
                "product": {
                  "name": "Red Hat JBoss Portal Platform 6.1",
                  "product_id": "Red Hat JBoss Portal Platform 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_portal_platform:6.1.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Portal"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-7852",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2014-11-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1164024"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that RichFaces accepted arbitrary strings included in a URL and returned them unencoded in a CSS file. A remote attacker could use this flaw to perform cross-site scripting (XSS) attacks against a user running a RichFaces application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "RichFaces: Cross-site scripting due to incomplete URL sanitization",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Portal Platform 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2014-7852"
        },
        {
          "category": "external",
          "summary": "RHBZ#1164024",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1164024"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2014-7852",
          "url": "https://www.cve.org/CVERecord?id=CVE-2014-7852"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-7852",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7852"
        }
      ],
      "release_date": "2014-12-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-12-09T17:56:38+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up all\napplications deployed on Red Hat JBoss Portal, along with all customized\nconfiguration files, and any databases and database settings.\n\nNote that it is recommended to halt the JBoss Portal server by stopping the\nJBoss Application Server process before installing this update, and then\nafter installing the update, restart the JBoss Portal server by starting\nthe JBoss Application Server process.",
          "product_ids": [
            "Red Hat JBoss Portal Platform 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:1973"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Portal Platform 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "RichFaces: Cross-site scripting due to incomplete URL sanitization"
    }
  ]
}