PT-2010-3676 · Apache · Apache Myfaces

Leonardo Uribe · Publicado 2010-10-20 · Atualizado 2022-05-17 · CVE-2010-2057

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache MyFaces versions 1.1.x through 1.1.7 Apache MyFaces versions 1.2.x through 1.2.8 Apache MyFaces versions 2.0.x through 2.0.0

Description The issue allows remote attackers to perform successful modifications of the View State via a padding oracle attack because shared/util/StateUtils.java uses an encrypted View State without a Message Authentication Code (MAC).

Recommendations For Apache MyFaces versions 1.1.x through 1.1.7, update to version 1.1.8 or later. For Apache MyFaces versions 1.2.x through 1.2.8, update to version 1.2.9 or later. For Apache MyFaces versions 2.0.x through 2.0.0, update to version 2.0.1 or later.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

CWE-310

Identificadores relacionados

CVE-2010-2057

GHSA-4FV4-CQ5V-X45M

Produtos afetados

Apache Myfaces

Referências · 5

• http://svn.apache.org/viewvc/myfaces/shared/trunk/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java?r1=943327&r2=951801 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2010-2057 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=623799 · Nota
• https://osv.dev/vulnerability/GHSA-4fv4-cq5v-x45m · Aviso do Fabricante
• https://issues.apache.org/jira/browse/MYFACES-2749 · Nota