Apache Myfaces vulnerabilities

5 CVEs affecting Apache Myfaces, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-26296, published 2021-02-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-4367, published 2014-06-19. Medium severity, CVSS 5.0. EPSS: 33.7% chance of exploitation in the next 30 days. Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a…
CVE-2011-4343, published 2017-08-08. High severity, CVSS 7.5. EPSS: 5.3% chance of exploitation in the next 30 days. Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.
CVE-2010-2057, published 2010-10-20. Medium severity, CVSS 5.0. EPSS: 3% chance of exploitation in the next 30 days. shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it…
CVE-2021-26296, published 2021-02-19. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site…
CVE-2010-2086, published 2010-05-27. Medium severity, CVSS 4.0. EPSS: 2.1% chance of exploitation in the next 30 days. Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct…