| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.myfaces.core:myfaces-core-module | ≥ 2.0.1, < 2.0.11≥ 2.1.0, < 2.1.5 | 2.0.112.1.5 |
| myfaces | = 2.0.1= 2.0.10= 2.0.2= 2.0.3= 2.0.4= 2.0.5= 2.0.6= 2.0.7= 2.0.8= 2.0.9= 2.1.0= 2.1.1= 2.1.2= 2.1.3= 2.1.4 |
Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free