GitHub Advisoryadvisory · Maven

GHSA-jq6g-p65r-44xr Apache MyFaces Vulnerable to EL Injection

HIGH Published 2022-05-17 Modified 2024-01-17 Official page ↗
Aliases
CVE-2011-4343
Ecosystem
Maven
Packages
org.apache.myfaces.core:myfaces-core-module
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-917
Reviewed
2024-01-17

Affected packages

• Maven org.apache.myfaces.core:myfaces-core-module: >= 2.0.1, < 2.0.11 → fixed in 2.0.11 • Maven org.apache.myfaces.core:myfaces-core-module: >= 2.1.0, < 2.1.5 → fixed in 2.1.5

Description

Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.

Related

Alias · CVE (1)

  • CVE-2011-4343 Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement weakness

References