Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2010-2057

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-4fv4-cq5v-x45m

Improper Authentication in Apache MyFaces shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.

gitlab/maven/org.apache.myfaces.core/myfaces-api/CVE-2010-2057

Improper Authentication in Apache MyFaces shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.

gitlab/maven/org.apache.myfaces.core/myfaces-impl/CVE-2010-2057

Encrypted view state does not include MAC `shared/util/StateUtils.java` in this package uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.

gitlab/maven/org.apache.myfaces.shared/myfaces-shared-core/CVE-2010-2057

Improper Authentication in Apache MyFaces shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.