CVE-2010-2057
apache myfaces: no CVSS score yet. EPSS 3.0% chance of exploitation in the next 30 days. Fixed in org.apache.myfaces.shared:myfaces-shared-core 1.1.8, 1.2.9, 2.0.1.
shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
- EPSS
- 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
- CWE
- CWE-310
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:myfaces
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4fv4-cq5v-x45m | Maven | org.apache.myfaces.shared:myfaces-shared-core | >=1.1.0 <1.1.8 | 1.1.8 |
| GHSA-4fv4-cq5v-x45m | Maven | org.apache.myfaces.shared:myfaces-shared-core | >=1.2.0 <1.2.9 | 1.2.9 |
| GHSA-4fv4-cq5v-x45m | Maven | org.apache.myfaces.shared:myfaces-shared-core | >=2.0.0 <2.0.1 | 2.0.1 |
| GHSA-4fv4-cq5v-x45m | Maven | org.apache.myfaces.core:myfaces-impl | >=1.1.0 <1.1.8 | 1.1.8 |
| GHSA-4fv4-cq5v-x45m | Maven | org.apache.myfaces.core:myfaces-impl | >=1.2.0 <1.2.9 | 1.2.9 |
| GHSA-4fv4-cq5v-x45m | Maven | org.apache.myfaces.core:myfaces-impl | >=2.0.0 <2.0.1 | 2.0.1 |
References
- http://svn.apache.org/viewvc/myfaces/shared/trunk/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java?r1=943327&r2=951801
- https://bugzilla.redhat.com/show_bug.cgi?id=623799
- https://issues.apache.org/jira/browse/MYFACES-2749
- http://svn.apache.org/viewvc/myfaces/shared/trunk/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java?r1=943327&r2=951801
- https://bugzilla.redhat.com/show_bug.cgi?id=623799