[PORTLETBRIDGE-236] Security vulnerability with _jsfBridgeViewId, __jpfbJSFTARGET and __jpfbJSFResTARGET URL parameter values

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 3.0.0, 3.0.0-alpha
• Fix Version/s: 3.0.0, 3.0.0-alpha
• Component/s: Impl
• Labels: security
• Assignee: Mike Kienenberger
• Reporter: Ross Clewley
• Created: 21/May/14 10:53
• Updated: 04/May/15 15:08
• Resolved: 04/May/15 15:08

Description

MyFaces Portlet Bridge has a security vulnerability in which the _jsfBridgeViewId, __jpfbJSFTARGET, and __jpfbJSFResTARGET request parameter values are not restricted to valid filename characters.