CVE-2013-5855
Improper Neutralization of Input During Web Page Generation in Mojarra
Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.
Exploit likelihood
What each source reports
NVD Score used
Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.
- Record
CVE-2013-5855- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.
- Record
CVE-2013-5855- Updated
- 2026-11-02
EUVDEUVD-2022-2207 No score
Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.
- Record
EUVD-2022-2207- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3m3r-82gc-53mj No score
Improper Neutralization of Input During Web Page Generation in Mojarra
Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.
- Record
GHSA-3m3r-82gc-53mj- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.
- Record
CVE-2013-5855- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-5855 No score
Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.
- Record
DEBIAN-CVE-2013-5855- Updated
- 2026-11-02
OSVGHSA-3m3r-82gc-53mj No score
Improper Neutralization of Input During Web Page Generation in Mojarra
Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.
- Record
GHSA-3m3r-82gc-53mj- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-5855 No score
Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.
- Record
UBUNTU-CVE-2013-5855- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.glassfish:javax.facesMaven |
2.2.0 up to 2.2.6 | 2.2.6 |
org.glassfish:javax.facesMaven |
2.1.0 up to 2.1.28 | 2.1.28 |
mojarraDebian:12 |
before 2.2.8-1 | 2.2.8-1 |
mojarraDebian:13 |
before 2.2.8-1 | 2.2.8-1 |
mojarraDebian:14 |
before 2.2.8-1 | 2.2.8-1 |
org.glassfish:javax.facesMaven |
2.2.0 up to 2.2.6, plus listed versions 2.2.12.2.22.2.32.2.42.2.5 |
2.2.6 |
org.glassfish:javax.facesMaven |
2.1.0 up to 2.1.28, plus listed versions 2.1.102.1.112.1.122.1.132.1.14 Show 45 moreShow less2.1.152.1.162.1.172.1.182.1.192.1.22.1.202.1.20-022.1.20-032.1.20-042.1.20-052.1.20-062.1.20-072.1.20-082.1.20-092.1.20-102.1.20-112.1.20-122.1.20-132.1.20-142.1.20-152.1.20-162.1.212.1.222.1.232.1.242.1.252.1.262.1.272.1.32.1.42.1.52.1.5-022.1.5-042.1.62.1.72.1.7-012.1.7-022.1.7-032.1.7-042.1.7-052.1.7-062.1.7-072.1.7-082.1.7-09 |
2.1.28 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-5855 is a medium vulnerability (CVSS 4.3) in Oracle Mojarra, published July 17, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.71%, the 91st percentile. Fixed in org.glassfish:javax.faces 2.2.6.
References
rhn.redhat.com/errata/RHSA-2015-0765.html
h30499.www3.hp.com/t5/HP-Security-Research-Blog/JSF-outputText-tag-the-good-the-bad-and-the-ugly/ba-p/6368011
vmware.com/security/advisories/VMSA-2014-0012.html
securityfocus.com/bid/65600
Show 12 moreShow less
java.net/jira/browse/JAVASERVERFACES_SPEC_PUBLIC-1258
oracle.com/technetwork/topics/security/cpujan2016-2367955.html
seclists.org/fulldisclosure/2014/Dec/23
nvd.nist.gov/vuln/detail/CVE-2013-5855
github.com/advisories/GHSA-3m3r-82gc-53mj
security-tracker.debian.org/tracker/CVE-2013-5855
ubuntu.com/security/CVE-2013-5855
cve.org/CVERecord?id=CVE-2013-5855
Left out here: 3 versions. The JSON record has them.