org.apache.myfaces.core/myfaces-core-module vulnerabilities

Latest org.apache.myfaces.core/myfaces-core-module CVEs

Newest publication first

1. CVE-2021-26296 Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces

   Published 2021-02-19

   High·CVSS 7.5 EPSS 2.9% Public exploit

   In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although diffic...

2. CVE-2011-4343 Apache MyFaces Vulnerable to EL Injection

   Published 2017-08-08

   High·CVSS 7.5 EPSS 5.3%

   Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.

3. CVE-2010-2086 Apache MyFaces Cross-site Scripting vulnerability

   Published 2010-05-27

   Medium·CVSS 4.0 EPSS 2.1%

   Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statem...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.