Apache MyFaces 2.x Cross Site Request Forgery

Ceritude Securiy Advisory - CSA-2021-001 PRODUCT : Apache MyFaces VENDOR : The Apache Software Foundation SEVERITY : High AFFECTED VERSION : =2.2.13, =2.3.7, =2.3-next-M4, =2.1 branches IDENTIFIERS : CVE-2021-26296 PATCH VERSION : 2.2.14, 2.3.8, 2.3-next-M5, 3.0.0 FOUND BY : Wolfgang Ettlinger,...

CVE-2021-26296

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery CSRF tokens. Due to that limitation, it is possible although difficult for an attacker ...

CVE-2021-26296

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery CSRF tokens. Due to that limitation, it is possible although difficult for an attacker ...

Cross site request forgery (csrf)

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery CSRF tokens. Due to that limitation, it is possible although difficult for an attacker ...

CVE-2021-26296 Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery CSRF tokens. Due to that limitation, it is possible although difficult for an attacker ...

CVE-2021-26296

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery CSRF tokens. Due to that limitation, it is possible although difficult for an attacker ...

Apache MyFaces Trinidad 跨站请求伪造漏洞

Apache MyFaces Trinidad is a U.S. Apache Apache Foundation contains a large number of enterprise-class component libraries and support for attachment JSF framework. A cross-site request forgery vulnerability exists in Apache MyFaces. The vulnerability stems from a lack of proper validation of...

IBM WebSphere Application Server 8.0.0.x < 8.0.0.15 / 8.5.x < 8.5.5.13 Multiple Vulnerabilities (296865)

The IBM WebSphere Application Server running on the remote host is version 8.0.0.x prior to 8.0.0.15 or 8.5.0.x prior to 8.5.5.13. It is, therefore, affected by two information disclosure vulnerabilities in the Java Server Faces JSF subcomponent. - IBM WebSphere Application Server allows a remote...

CVE-2011-4367

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces JSF in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. dot dot in the 1 ln parameter to faces/javax.faces.resource/web.xml or 2 the PATHINFO to...

Security Bulletin: Remote code execution vulnerability in the JSF used by WebSphere Application Server shipped with Jazz for Service Management

Summary There is a remote code execution vulnerability in the JSF Sun Reference Implementation 1.2 used by WebSphere Application Server. The JSF Sun Reference Implementation 1.2 is used as the default in WebSphere Application Server v7.0, other versions it is not the default. Vulnerability Detail...

Security Bulletin: Remote code execution vulnerability in the JSF used by WebSphere Application Server

Summary There is a remote code execution vulnerability in the JSF Sun Reference Implementation 1.2 used by WebSphere Application Server. The JSF Sun Reference Implementation 1.2 is used as the default in WebSphere Application Server v7.0, other versions it is not the default. Vulnerability Detail...

Security Bulletin: Multiple vulnerabilities affect Java Server Faces (JSF) used by WebSphere Application Server shipped with Jazz for Service Management (CVE-2017-1583, CVE-2011-4343)

Summary There are two potential information disclosure vulnerabilities that affects the Java Server Faces JSF component used by WebSphere Application Server. Vulnerability Details CVEID: CVE-2017-1583 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to obtain sensitive...

Security Bulletin: Information disclosure in WebSphere Application Server Liberty affects IBM MessageSight (CVE-2011-4343)

Summary There is an information disclosure vulnerability in IBM WebSphere Application Server Liberty. IBM WebSphere Application Server Liberty is used by IBM MessageSight. IBM MessageSight has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2011-4343 DESCRIPTION: Apache MyFaces cou...

Security Bulletin: Content Collector for Email is affected by vulnerability due to information disclosure in Apache MyFaces

Summary Content Collector for Email has addressed following vulnerability: Apache MyFaces could allow a remote attacker using specially crafted parameters to inject EL expressions into input fields mapped as view parameters and obtain sensitive information. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server affects IBM Emptoris Strategic Supply Management suite of products and IBM Emptoris Services Procurement (CVE-2017-1583, CVE-2011-4343)

Summary The IBM Emptoris Contract Management ,IBM Emptoris Program Management, IBM Emptoris Sourcing, IBM Emptoris Spend Analysis and IBM Emptoris Services Procurement products are affected by a vulnerability that exists in the IBM WebSphere Application Server. The security bulletin includes issu...

Security Bulletin: A Security vulnerability has been identified in IBM WebSphere Application Server bundled with IBM WebSphere Application Server Patterns and IBM WebSphere Application Server for Cloud (CVE-2017-1583, CVE-2011-4343)

Summary There are two potential infomation disclosure vulnerabilities that affects the Java Server Faces JSF component used by WebSphere Application Server. Vulnerability Details CVEID: CVE-2017-1583 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to obtain sensitive...

Security Bulletin: Multiple security vulnerabilities affect Liberty for Java for IBM Bluemix (CVE-2017-1583, CVE-2011-4343)

Summary There is a potential infomation disclosure vulnerability that affects the Java Server Faces JSF component used by WebSphere Application Server. There is a potential infomation disclosure vulnerability that affects the MyFaces component used by JSF in WebSphere Application Server...

Security Bulletin: Multiple vulnerabilities affect Java Server Faces (JSF) used by WebSphere Application Server (CVE-2017-1583, CVE-2011-4343)

Summary There are two potential infomation disclosure vulnerabilities that affects the Java Server Faces JSF component used by WebSphere Application Server. Vulnerability Details CVEID: CVE-2017-1583 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to obtain sensitive...

CVE-2011-4343

Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters...

Information disclosure

Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters...