CVE-2010-4007: Oracle Mojarra

Medium severity, CVSS 5.0. EPSS: 1% chance of exploitation in the next 30 days.

Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057.

Affected products

• Oracle Mojarra: version 1.1 only; version 1.1_02 only; version 1.2 only; version 1.2_01 only; version 1.2_02 only; version 1.2_03 only; …

Published 2010-10-20. Last modified 2026-06-16.