PT-2017-5003 · Apache · Apache Myfaces Core

Balusc + 1 · Published 2017-08-08 · Updated 2022-05-17 · CVE-2011-4343

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache MyFaces Core versions 2.0.1 through 2.0.10 Apache MyFaces Core versions 2.1.0 through 2.1.4

Description: The issue allows remote attackers to inject EL expressions via crafted parameters, potentially leading to information disclosure.

Recommendations: For Apache MyFaces Core versions 2.0.1 through 2.0.10, update to a version outside of this range to resolve the issue. For Apache MyFaces Core versions 2.1.0 through 2.1.4, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to parameters that can be used to inject EL expressions until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-917

CWE-200

Related Identifiers

CVE-2011-4343

GHSA-JQ6G-P65R-44XR

Affected Products

Apache Myfaces Core

References · 8

• https://osv.dev/vulnerability/GHSA-jq6g-p65r-44xr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4343 · Security Note
• https://issues.apache.org/jira/secure/attachment/12504807/MYFACES-3405-1.patch · Vendor Advisory
• https://github.com/apache/myfaces/commit/caee86e71ab8c5f038186158e9955887ed72a0fd · Note
• https://github.com/apache/myfaces/commit/a74b551b2ce6e88101ff453389a761f230e428a1 · Note
• https://github.com/apache/myfaces · Note
• http://securitytracker.com/id/1039695 · Note
• http://marc.info/?l=full-disclosure&m=132313252814362 · Note