CVE-2010-4007

2010-10-2018:00:00

CWE-310

[email protected]

web.nvd.nist.gov

551

oracle mojarra

view state

encrypted

mac

remote attackers

modifications

cve-2010-4007

6.7 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

43.0%

JSON

Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057.

CPENameOperatorVersion
oracle:mojarraoracle mojarraeq1.2_05
oracle:mojarraoracle mojarraeq1.1_02
oracle:mojarraoracle mojarraeq1.1
oracle:mojarraoracle mojarraeq1.2_13
oracle:mojarraoracle mojarraeq1.2
oracle:mojarraoracle mojarraeq1.2_06
oracle:mojarraoracle mojarraeq1.2_10
oracle:mojarraoracle mojarraeq1.2_08
oracle:mojarraoracle mojarraeq2.0.0
oracle:mojarraoracle mojarraeq1.2_04

CPE	Name	Operator	Version
oracle:mojarra	oracle mojarra	eq	1.2_05
oracle:mojarra	oracle mojarra	eq	1.1_02
oracle:mojarra	oracle mojarra	eq	1.1
oracle:mojarra	oracle mojarra	eq	1.2_13
oracle:mojarra	oracle mojarra	eq	1.2
oracle:mojarra	oracle mojarra	eq	1.2_06
oracle:mojarra	oracle mojarra	eq	1.2_10
oracle:mojarra	oracle mojarra	eq	1.2_08
oracle:mojarra	oracle mojarra	eq	2.0.0
oracle:mojarra	oracle mojarra	eq	1.2_04