| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.myfaces.core:myfaces-impl | ≥ 1.1.0, < 1.1.8≥ 1.2.0, < 1.2.9≥ 2.0.0, < 2.0.1 | 1.1.81.2.92.0.1 |
| org.apache.myfaces.shared:myfaces-shared-core | ≥ 1.1.0, < 1.1.8≥ 1.2.0, < 1.2.9≥ 2.0.0, < 2.0.1 | 1.1.81.2.92.0.1 |
| myfaces | = 1.1.0= 1.1.1= 1.1.2= 1.1.3= 1.1.4= 1.1.5= 1.1.6= 1.1.7= 1.2.2= 1.2.3= 1.2.4= 1.2.5= 1.2.6= 1.2.7= 1.2.8= 2.0.0 |
shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free