High severity · published Aug 8, 2017
CVE-2011-4343
Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters
7.5
CVSS
5.3%
EPSS
No
On KEV
Description
Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.3% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MY
Myfaces · Apache
2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6; +9 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4343
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4343
Third Party Advisory
http://marc.info/?l=full-disclosure&m=132313252814362
www.securitytracker.com
http://www.securitytracker.com/id/1039695
Patch
https://issues.apache.org/jira/secure/attachment/12504807/MYFACES-3405-1.patch
More from Myfaces
7.5
CVE-2021-26296
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and…
–
CVE-2011-4367
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read…
–
CVE-2010-2057
shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code…
–
CVE-2010-2086
Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote…