Lucene search

[email protected]CVE-2021-26296

HistoryFeb 19, 2021 - 9:15 a.m.

CVE-2021-26296

2021-02-1909:15:13

CWE-352

[email protected]

web.nvd.nist.gov

cve

2021

26296

apache

myfaces

core

csrf

tokens

security

vulnerability

nvd

5.1 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.4%

JSON

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.

Affected configurations

Vulners

NVD

Node

apachemyfacesRange≤2.2.14

apachemyfacesRange≤2.3.8

apachemyfacesRange≤2.3-next-M5

apachemyfacesRange≤3.0.0

CPENameOperatorVersion
apache:myfacesapache myfacesle2.2.13
apache:myfacesapache myfacesle2.3.7
apache:myfacesapache myfaceseq2.3
apache:myfacesapache myfaceseq3.0.0

CPE	Name	Operator	Version
apache:myfaces	apache myfaces	le	2.2.13
apache:myfaces	apache myfaces	le	2.3.7
apache:myfaces	apache myfaces	eq	2.3
apache:myfaces	apache myfaces	eq	3.0.0

CNA Affected

[
  {
    "product": "Apache MyFaces Core",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.2.14",
        "status": "affected",
        "version": "Apache MyFaces Core 2.2",
        "versionType": "custom"
      },
      {
        "lessThan": "2.3.8",
        "status": "affected",
        "version": "Apache MyFaces Core 2.3",
        "versionType": "custom"
      },
      {
        "lessThan": "2.3-next-M5",
        "status": "affected",
        "version": "Apache MyFaces Core 2.3-next",
        "versionType": "custom"
      },
      {
        "lessThan": "3.0.0",
        "status": "affected",
        "version": "Apache MyFaces Core 3.0",
        "versionType": "custom"
      }
    ]
  }
]