What is GHSA-92cv-wv2c-8899?

GHSA-92cv-wv2c-8899 is a security advisory published by GitHub Security Advisories with Medium severity. Apache MyFaces Cross-site Scripting vulnerability

Which CVE IDs does GHSA-92cv-wv2c-8899 cover?

GHSA-92cv-wv2c-8899 covers the following CVE IDs: CVE-2010-2086. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-92cv-wv2c-8899?

GHSA-92cv-wv2c-8899 affects 2 products, including: maven/org.apache.myfaces.core:myfaces-core-module:\u003c= 1.1.7; maven/org.apache.myfaces.core:myfaces-core-module:\u003e= 1.2.0, \u003c= 1.2.8.

GHSA-92cv-wv2c-8899Medium

Apache MyFaces Cross-site Scripting vulnerability

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

February 8, 2024

🔗 CVE IDs covered (1)

CVE-2010-2086 →

📋 Description

Apache MyFaces 1.1.7 and 1.2.8 (All previous versions are likely vulnerable), as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.

🎯 Affected products2

maven/org.apache.myfaces.core:myfaces-core-module:<= 1.1.7
maven/org.apache.myfaces.core:myfaces-core-module:>= 1.2.0, <= 1.2.8

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2010-2086
https://www.trustwave.com/spiderlabs/advisories/TWSL2010-001.txt
http://www.blackhat.com/presentations/bh-dc-10/Byrne_David/BlackHat-DC-2010-Byrne-SGUI-slides.pdf
https://github.com/advisories/GHSA-92cv-wv2c-8899