| Package | Affected versions | Patched versions |
|---|---|---|
| de.ipb-halle:molecularfaces | < 0.3.0 | 0.3.0 |
| molecularfaces | < 0.3.0 | 0.3.0 |
The viewer plugin implementation of <mol:molecule> renders molfile data directly inside a <script> tag without any escaping. Arbitrary JavaScript code can thus be executed in the client browser via crafted molfiles.
Patched in v0.3.0: Molfile data is now rendered as value of a hidden <input> tag and escaped via JSF's mechanisms.
No workaround available.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free