CVE-2010-2057: Improper Authentication in Apache MyFaces

May 17, 2022 (updated July 8, 2022)

shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.

References

svn.apache.org/viewvc/myfaces/shared/trunk/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java?r1=943327&r2=951801
bugzilla.redhat.com/show_bug.cgi?id=623799
github.com/advisories/GHSA-4fv4-cq5v-x45m
issues.apache.org/jira/browse/MYFACES-2749
nvd.nist.gov/vuln/detail/CVE-2010-2057

Code Behaviors & Features

Detect and mitigate CVE-2010-2057 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →