CVE-2010-2057
published 2010-10-20CVE-2010-2057: shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message…
PriorityP425medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
3.10%
86.3th percentile
shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | myfaces | — | — |
| apache | myfaces | — | — |
| apache | myfaces | — | — |
| apache | myfaces | — | — |
| apache | myfaces | — | — |
| apache | myfaces | — | — |
| apache | myfaces | — | — |
| apache | myfaces | — | — |
| apache | myfaces | — | — |
| apache | myfaces | — | — |
| apache | myfaces | — | — |
| apache | myfaces | — | — |
| apache | myfaces | — | — |
| apache | myfaces | — | — |
| apache | myfaces | — | — |
| apache | myfaces | — | — |
| debian | mojarra | — | — |
| oracle | mojarra | — | — |
| oracle | mojarra | — | — |
| oracle | mojarra | — | — |
| oracle | mojarra | — | — |
| oracle | mojarra | — | — |
| oracle | mojarra | — | — |
| oracle | mojarra | — | — |
| oracle | mojarra | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vendor_debian5.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper Authentication in Apache MyFaces
ghsa·2022-05-17
CVE-2010-2057 [MEDIUM] CWE-287 Improper Authentication in Apache MyFaces
Improper Authentication in Apache MyFaces
shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
OSV
Improper Authentication in Apache MyFaces
osv·2022-05-17
CVE-2010-2057 [MEDIUM] Improper Authentication in Apache MyFaces
Improper Authentication in Apache MyFaces
shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
GHSA
GHSA-v49c-75x7-q86w: Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform success
ghsa_unreviewed·2022-05-17·CVSS 5.0
CVE-2010-4007 [MEDIUM] GHSA-v49c-75x7-q86w: Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform success
Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057.
Debian
CVE-2010-4007: mojarra - Oracle Mojarra uses an encrypted View State without a Message Authentication Cod...
vendor_debian·2010·CVSS 5.0
CVE-2010-4007 [MEDIUM] CVE-2010-4007: mojarra - Oracle Mojarra uses an encrypted View State without a Message Authentication Cod...
Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2010-2057 Apache MyFaces: encrypted view state does not include MAC
bugzilla·2010-08-12·CVSS 5.0
CVE-2010-2057 [MEDIUM] CVE-2010-2057 Apache MyFaces: encrypted view state does not include MAC
CVE-2010-2057 Apache MyFaces: encrypted view state does not include MAC
Quoting the upstream bug report [1]:
Both myfaces and mojarra only encrypt the state. What is missing is add a message authentication code (MAC) to the encryption to prevent padding oracle attack. The objective is detect if the received view state has been modified and do not process it, throwing ViewExpiredException.
The problem can be solved if users change to server side state saving, because on the view state only a identifier is sent and no changes on the component tree could be done with this configuration.
The proposed solution was add this new web-config params:
org.apache.myfaces.MAC_ALGORITHM : Indicate the algorithm used to calculate the Message Authentication Code that is added to the view state.
org.
Bugzilla
CVE-2010-2086 MyFaces: XSS via state view
bugzilla·2010-05-31·CVSS 5.0
CVE-2010-2086 [MEDIUM] CVE-2010-2086 MyFaces: XSS via state view
CVE-2010-2086 MyFaces: XSS via state view
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2086 to
the following vulnerability:
Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application
Server and other applications, does not properly handle an unencrypted
view state, which allows remote attackers to conduct cross-site
scripting (XSS) attacks or execute arbitrary Expression Language (EL)
statements via vectors that involve modifying the serialized view
object.
References:
[1] http://www.blackhat.com/presentations/bh-dc-10/Byrne_David/BlackHat-DC-2010-Byrne-SGUI-slides.pdf
[2] https://www.trustwave.com/spiderlabs/advisories/TWSL2010-001.txt
[3] http://myfaces.apache.org/
Discussion:
I believe that encryption support was added in MyFaces 1.1.1, so earlier
http://svn.apache.org/viewvc/myfaces/shared/trunk/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java?r1=943327&r2=951801https://bugzilla.redhat.com/show_bug.cgi?id=623799https://issues.apache.org/jira/browse/MYFACES-2749http://svn.apache.org/viewvc/myfaces/shared/trunk/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java?r1=943327&r2=951801https://bugzilla.redhat.com/show_bug.cgi?id=623799https://issues.apache.org/jira/browse/MYFACES-2749
2010-10-20
Published