GitHub Advisoryadvisory · Maven

GHSA-92cv-wv2c-8899 Apache MyFaces Cross-site Scripting vulnerability

MEDIUM Published 2022-05-17 Modified 2024-02-08 Official page ↗
Aliases
CVE-2010-2086
Ecosystem
Maven
Packages
org.apache.myfaces.core:myfaces-core-module
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-02-08

Affected packages

• Maven org.apache.myfaces.core:myfaces-core-module: <= 1.1.7 (no fix yet) • Maven org.apache.myfaces.core:myfaces-core-module: >= 1.2.0, <= 1.2.8 (no fix yet)

Description

Apache MyFaces 1.1.7 and 1.2.8 (All previous versions are likely vulnerable), as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.

Related

Alias · CVE (1)

  • CVE-2010-2086 Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References