En bref
- CVE-2010-2086 est une vulnérabilité MOYENNE (CVSS 4.0) touchant org.apache.myfaces.core:myfaces-core-module, myfaces (apache).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.1%, plus élevée que 81.9% des vulnérabilités.
- Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.
Description
Apache MyFaces 1.1.7 and 1.2.8 (All previous versions are likely vulnerable), as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
NVD description
Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
Autres vulnérabilités de org.apache.myfaces.core:myfaces-core-module
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free