PT-2017-5003 · Apache · Apache Myfaces Core

Balusc + 1 · Publicado 2017-08-08 · Atualizado 2022-05-17 · CVE-2011-4343

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache MyFaces Core versions 2.0.1 through 2.0.10 Apache MyFaces Core versions 2.1.0 through 2.1.4

Description: The issue allows remote attackers to inject EL expressions via crafted parameters, potentially leading to information disclosure.

Recommendations: For Apache MyFaces Core versions 2.0.1 through 2.0.10, update to a version outside of this range to resolve the issue. For Apache MyFaces Core versions 2.1.0 through 2.1.4, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to parameters that can be used to inject EL expressions until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-917

CWE-200

Identificadores relacionados

CVE-2011-4343

GHSA-JQ6G-P65R-44XR

Produtos afetados

Apache Myfaces Core

Referências · 8

• https://github.com/apache/myfaces/commit/caee86e71ab8c5f038186158e9955887ed72a0fd · Nota
• https://github.com/apache/myfaces/commit/a74b551b2ce6e88101ff453389a761f230e428a1 · Nota
• https://github.com/apache/myfaces · Nota
• http://securitytracker.com/id/1039695 · Nota
• https://osv.dev/vulnerability/GHSA-jq6g-p65r-44xr · Aviso do Fabricante
• http://marc.info/?l=full-disclosure&m=132313252814362 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4343 · Nota de Segurança
• https://issues.apache.org/jira/secure/attachment/12504807/MYFACES-3405-1.patch · Aviso do Fabricante