CVE-2008-1285
Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF)
4.3 MediumFix available
Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Exploit likelihood
2.54%Down 0.9 points since Feb 4, 2022
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Record
CVE-2008-1285- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Record
CVE-2008-1285- Updated
- 2026-11-02
EUVDEUVD-2022-5430 No score
Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Record
EUVD-2022-5430- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vv6j-5x58-q2c3
Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF)
Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Record
GHSA-vv6j-5x58-q2c3- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-vv6j-5x58-q2c3
Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF)
Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Record
GHSA-vv6j-5x58-q2c3- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.sun.faces:jsf-apiMaven |
before 1.2.08 | 1.2.08 |
com.sun.faces:jsf-apiMaven |
before 1.2.08, plus listed versions 1.2 |
1.2.08 |
glassfish-javamailRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 2 CVEs |
before 0:1.4.0-0jpp.ep1.9.el4 | 0:1.4.0-0jpp.ep1.9.el4 |
hibernate3Red Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 2 CVEs |
before 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4 | 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4 |
hibernate3-annotationsRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 2 CVEs |
before 0:3.2.1-1.patch02.1jpp.ep1.3.el4 | 0:3.2.1-1.patch02.1jpp.ep1.3.el4 |
hibernate3-annotations-javadocRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 2 CVEs |
before 0:3.2.1-1.patch02.1jpp.ep1.3.el4 | 0:3.2.1-1.patch02.1jpp.ep1.3.el4 |
hibernate3-javadocRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 2 CVEs |
before 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4 | 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4 |
jboss-cacheRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 2 CVEs |
before 0:1.4.1-4.SP9.1jpp.ep1.1.el4 | 0:1.4.1-4.SP9.1jpp.ep1.1.el4 |
jboss-remotingRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 2 CVEs |
before 0:2.2.2-3.SP7.0jpp.ep1.3.el4 | 0:2.2.2-3.SP7.0jpp.ep1.3.el4 |
jboss-seamRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 2 CVEs |
before 0:1.2.1-1.ep1.7.el4 | 0:1.2.1-1.ep1.7.el4 |
Show 64 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jboss-seam-docsRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 2 CVEs |
before 0:1.2.1-1.ep1.7.el4 | 0:1.2.1-1.ep1.7.el4 |
jbossasRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 2 CVEs |
before 0:4.2.0-3.GA_CP03.ep1.9.el4 | 0:4.2.0-3.GA_CP03.ep1.9.el4 |
jbosstsRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 2 CVEs |
before 1:4.2.3-1.SP5_CP01.1jpp.ep1.1.el4 | 1:4.2.3-1.SP5_CP01.1jpp.ep1.1.el4 |
jcommonRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 2 CVEs |
before 0:1.0.12-1jpp.ep1.3.el4 | 0:1.0.12-1jpp.ep1.3.el4 |
jfreechartRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 2 CVEs |
before 0:1.0.9-1jpp.ep1.3.el4 | 0:1.0.9-1jpp.ep1.3.el4 |
rh-eap-docsRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 2 CVEs |
before 0:4.2.0-3.GA_CP03.ep1.5.el4 | 0:4.2.0-3.GA_CP03.ep1.5.el4 |
rh-eap-docs-examplesRed Hat:jboss_enterprise_application_platform:4.2.0::el4 From an advisory covering 2 CVEs |
before 0:4.2.0-3.GA_CP03.ep1.5.el4 | 0:4.2.0-3.GA_CP03.ep1.5.el4 |
glassfish-javamailRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 0:1.4.0-0jpp.ep1.9.el4 | 0:1.4.0-0jpp.ep1.9.el4 |
hibernate3Red Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4 | 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4 |
hibernate3-annotationsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 0:3.2.1-1.patch02.1jpp.ep1.3.el4 | 0:3.2.1-1.patch02.1jpp.ep1.3.el4 |
hibernate3-annotations-javadocRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 0:3.2.1-1.patch02.1jpp.ep1.3.el4 | 0:3.2.1-1.patch02.1jpp.ep1.3.el4 |
hibernate3-javadocRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4 | 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el4 |
jboss-aopRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 0:1.5.5-1.CP01.0jpp.ep1.1.el4 | 0:1.5.5-1.CP01.0jpp.ep1.1.el4 |
jboss-cacheRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 0:1.4.1-4.SP9.1jpp.ep1.1.el4 | 0:1.4.1-4.SP9.1jpp.ep1.1.el4 |
jboss-messagingRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 0:1.4.0-1.SP3_CP02.0jpp.ep1.6.el4 | 0:1.4.0-1.SP3_CP02.0jpp.ep1.6.el4 |
jboss-remotingRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 0:2.2.2-3.SP7.0jpp.ep1.3.el4 | 0:2.2.2-3.SP7.0jpp.ep1.3.el4 |
jboss-seamRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.7.el4 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.7.el4 |
jboss-seam-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.7.el4 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.7.el4 |
jbossasRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 0:4.3.0-2.GA_CP01.ep1.7.el4 | 0:4.3.0-2.GA_CP01.ep1.7.el4 |
jbosstsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 1:4.2.3-1.SP5_CP01.1jpp.ep1.1.el4 | 1:4.2.3-1.SP5_CP01.1jpp.ep1.1.el4 |
jbosswsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 0:2.0.1-2.SP2_CP01.0jpp.ep1.2.el4 | 0:2.0.1-2.SP2_CP01.0jpp.ep1.2.el4 |
jcommonRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 0:1.0.12-1jpp.ep1.3.el4 | 0:1.0.12-1jpp.ep1.3.el4 |
jfreechartRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 0:1.0.9-1jpp.ep1.3.el4 | 0:1.0.9-1jpp.ep1.3.el4 |
jgroupsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 1:2.4.2-1.GA_CP01.0jpp.ep1.1.el4 | 1:2.4.2-1.GA_CP01.0jpp.ep1.1.el4 |
rh-eap-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 0:4.3.0-2.GA_CP01.ep1.4.el4 | 0:4.3.0-2.GA_CP01.ep1.4.el4 |
rh-eap-docs-examplesRed Hat:jboss_enterprise_application_platform:4.3.0::el4 From an advisory covering 2 CVEs |
before 0:4.3.0-2.GA_CP01.ep1.4.el4 | 0:4.3.0-2.GA_CP01.ep1.4.el4 |
hibernate3Red Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 2 CVEs |
before 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el5 | 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el5 |
hibernate3-annotationsRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 2 CVEs |
before 0:3.2.1-1.patch02.1jpp.ep1.3.el5.1 | 0:3.2.1-1.patch02.1jpp.ep1.3.el5.1 |
hibernate3-annotations-javadocRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 2 CVEs |
before 0:3.2.1-1.patch02.1jpp.ep1.3.el5.1 | 0:3.2.1-1.patch02.1jpp.ep1.3.el5.1 |
hibernate3-javadocRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 2 CVEs |
before 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el5 | 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el5 |
jboss-cacheRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 2 CVEs |
before 0:1.4.1-4.SP9.1jpp.ep1.1.el5 | 0:1.4.1-4.SP9.1jpp.ep1.1.el5 |
jboss-remotingRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 2 CVEs |
before 0:2.2.2-3.SP7.0jpp.ep1.3.el5 | 0:2.2.2-3.SP7.0jpp.ep1.3.el5 |
jboss-seamRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 2 CVEs |
before 0:1.2.1-1.ep1.6.el5 | 0:1.2.1-1.ep1.6.el5 |
jboss-seam-docsRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 2 CVEs |
before 0:1.2.1-1.ep1.6.el5 | 0:1.2.1-1.ep1.6.el5 |
jbossasRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 2 CVEs |
before 0:4.2.0-4.GA_CP03.ep1.8.el5.1 | 0:4.2.0-4.GA_CP03.ep1.8.el5.1 |
jbosstsRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 2 CVEs |
before 1:4.2.3-1.SP5_CP01.1jpp.ep1.1.el5 | 1:4.2.3-1.SP5_CP01.1jpp.ep1.1.el5 |
jcommonRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 2 CVEs |
before 0:1.0.12-1jpp.ep1.3.el5 | 0:1.0.12-1jpp.ep1.3.el5 |
jfreechartRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 2 CVEs |
before 0:1.0.9-1jpp.ep1.3.el5.1 | 0:1.0.9-1jpp.ep1.3.el5.1 |
rh-eap-docsRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 2 CVEs |
before 0:4.2.0-3.GA_CP03.ep1.5.el5 | 0:4.2.0-3.GA_CP03.ep1.5.el5 |
rh-eap-docs-examplesRed Hat:jboss_enterprise_application_platform:4.2.0::el5 From an advisory covering 2 CVEs |
before 0:4.2.0-3.GA_CP03.ep1.5.el5 | 0:4.2.0-3.GA_CP03.ep1.5.el5 |
asmRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:1.5.3-1jpp.ep1.2.el5 | 0:1.5.3-1jpp.ep1.2.el5 |
cglibRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:2.1.3-2jpp.ep1.6.el5 | 0:2.1.3-2jpp.ep1.6.el5 |
concurrentRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:1.3.4-8jpp.ep1.6.el5.1 | 0:1.3.4-8jpp.ep1.6.el5.1 |
glassfish-jsfRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:1.2_08-0jpp.ep1.2.el5 | 0:1.2_08-0jpp.ep1.2.el5 |
hibernate3Red Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el5 | 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el5 |
hibernate3-annotationsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:3.2.1-1.patch02.1jpp.ep1.3.el5.1 | 0:3.2.1-1.patch02.1jpp.ep1.3.el5.1 |
hibernate3-annotations-javadocRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:3.2.1-1.patch02.1jpp.ep1.3.el5.1 | 0:3.2.1-1.patch02.1jpp.ep1.3.el5.1 |
hibernate3-entitymanagerRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:3.2.1-1jpp.ep1.7.el5 | 0:3.2.1-1jpp.ep1.7.el5 |
hibernate3-entitymanager-javadocRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:3.2.1-1jpp.ep1.7.el5 | 0:3.2.1-1jpp.ep1.7.el5 |
hibernate3-javadocRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el5 | 1:3.2.4-1.SP1_CP03.0jpp.ep1.1.el5 |
jboss-aopRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:1.5.5-1.CP01.0jpp.ep1.1.el5 | 0:1.5.5-1.CP01.0jpp.ep1.1.el5 |
jboss-cacheRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:1.4.1-4.SP9.1jpp.ep1.1.el5 | 0:1.4.1-4.SP9.1jpp.ep1.1.el5 |
jboss-messagingRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:1.4.0-1.SP3_CP02.0jpp.ep1.6.el5 | 0:1.4.0-1.SP3_CP02.0jpp.ep1.6.el5 |
jboss-remotingRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:2.2.2-3.SP7.0jpp.ep1.3.el5 | 0:2.2.2-3.SP7.0jpp.ep1.3.el5 |
jboss-seamRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1 |
jboss-seam-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1 | 0:1.2.1-3.JBPAPP_4_3_0_GA.ep1.5.el5.1 |
jbossasRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:4.3.0-2.GA_CP01.ep1.6.el5.1 | 0:4.3.0-2.GA_CP01.ep1.6.el5.1 |
jbosstsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 1:4.2.3-1.SP5_CP01.1jpp.ep1.1.el5 | 1:4.2.3-1.SP5_CP01.1jpp.ep1.1.el5 |
jbosswsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:2.0.1-2.SP2_CP01.0jpp.ep1.2.el5 | 0:2.0.1-2.SP2_CP01.0jpp.ep1.2.el5 |
jbossxbRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:1.0.0-2.SP1.0jpp.ep1.2.el5.1 | 0:1.0.0-2.SP1.0jpp.ep1.2.el5.1 |
jcommonRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:1.0.12-1jpp.ep1.3.el5 | 0:1.0.12-1jpp.ep1.3.el5 |
jfreechartRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:1.0.9-1jpp.ep1.3.el5.1 | 0:1.0.9-1jpp.ep1.3.el5.1 |
jgroupsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 1:2.4.2-1.GA_CP01.0jpp.ep1.1.el5 | 1:2.4.2-1.GA_CP01.0jpp.ep1.1.el5 |
rh-eap-docsRed Hat:jboss_enterprise_application_platform:4.3.0::el5 From an advisory covering 2 CVEs |
before 0:4.3.0-2.GA_CP01.ep1.4.el5 | 0:4.3.0-2.GA_CP01.ep1.4.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1285 is a medium vulnerability (CVSS 4.3) in Sun Jsf, published March 11, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.54%, the 85th percentile. Fixed in com.sun.faces:jsf-api 1.2.08.
References
rhn.redhat.com/errata/RHSA-2008-0828.html
sunsolve.sun.com/search/document.do?assetkey=1-26-233561-1
exchange.xforce.ibmcloud.com/vulnerabilities/41081
jira.jboss.org/jira/browse/JBPAPP-682
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=437082
Show 27 moreShow less
redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp03/html-single/readme/index.html
vupen.com/english/advisories/2008/0808/references
securityfocus.com/bid/28192
secunia.com/advisories/29327
securitytracker.com/id?1020628
nvd.nist.gov/vuln/detail/CVE-2008-1285
github.com/advisories/GHSA-vv6j-5x58-q2c3
access.redhat.com/errata/RHSA-2008:0825
security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0825.json
cve.org/CVERecord?id=CVE-2008-1285