AppScan identified a "Link Injection" vulnerability that is related to the ICEfaces code library. The detail is provided below :

          [2 of 53] Link Injection (facilitates Cross-Site Request Forgery)
          Severity: Medium
          Test Type: Application
          Vulnerable URL: http://edsdev.blueweb.bcbsma.com:81/dmreg/block/send-receive-updates
          (Parameter = ice.focus)
          Remediation Tasks: Filter out hazardous characters from user input
          Variant 1 of 132 [ID=15343]
          The following changes were applied to the original request:
          ? Set parameter 'ice.focus's value to '%22%27%3E%3CIMG+SRC%3D%22%
          2FWF_XSRF.html%22%3E'
          Validation In Response:
          ? Fix.start('mainForm:
          _id35:0:historyPopup','/dmreg/xmlhttp/blank');Ice.Focus.setFocus('"'><IMG
          SRC="/WF_XSRF.html">');//-269488648]]></content></update></updates>
          Reasoning:
          The test response contained a link to the file "WF_XSRF.html, which proves that the Cross-Site
          Request Forgery attempt was successful