CVE-2011-4343: Apache Myfaces

High severity, CVSS 7.5. EPSS: 5.3% chance of exploitation in the next 30 days.

Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.

Affected products

• Apache Myfaces: version 2.0.1 only; version 2.0.2 only; version 2.0.3 only; version 2.0.4 only; version 2.0.5 only; version 2.0.6 only; …

Published 2017-08-08. Last modified 2026-06-16.