CVE-2016-5019 Apache MyFaces Trinidad Deserialization Vulnerability
CriticalCVSS 9.8
EPSS 8.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized view state string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.myfaces.trinidad/trinidad(Maven) | >= 1.0.0, <= 1.0.13 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | >= 1.2.0, < 1.2.15 | 1.2.15 |
| org.apache.myfaces.trinidad/trinidad(Maven) | >= 2.0.0, < 2.0.2 | 2.0.2 |
| org.apache.myfaces.trinidad/trinidad(Maven) | >= 2.1.0, < 2.1.2 | 2.1.2 |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.0.1 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.0.10 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.0.11 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.0.12 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.0.13 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.0.2 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.0.3 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.0.4 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.0.5 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.0.6 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.0.7 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.0.8 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.0.9 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.2.1 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.2.10 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.2.11 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.2.12 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.2.13 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.2.14 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.2.2 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.2.3 | No fix listed |
Show 14 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.2.4 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.2.5 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.2.6 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.2.7 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.2.8 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 1.2.9 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 2.0.0 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 2.0.1 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 2.1.0 | No fix listed |
| org.apache.myfaces.trinidad/trinidad(Maven) | = 2.1.1 | No fix listed |
| apache myfaces trinidad | >= 1.0.0, < 1.0.13 | 1.0.13 |
| apache myfaces trinidad | >= 1.2.0, < 1.2.15 | 1.2.15 |
| apache myfaces trinidad | >= 2.0.0, < 2.0.2 | 2.0.2 |
| apache myfaces trinidad | >= 2.1.0, < 2.1.2 | 2.1.2 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- issues.apache.org vendor-advisory
- www.oracle.com
- www.oracle.com
- [myfaces-users] 20160929 Re: CVE-2016-5019: MyFaces Trinidad view state deserialization security vulnerability mailing-list vendor-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- www.oracle.com patch
- www.oracle.com patch
- www.oracle.com patch
- www.oracle.com patch
- www.oracle.com patch
- www.oracle.com patch
- web.archive.org
- web.archive.org
- github.com
- github.com product
- 93236 third-party-advisory vdb-entry
- 1037633 third-party-advisory vdb-entry