Apache Software Foundation Apache Myfaces Core vulnerabilities

1 known vulnerability affecting apache_software_foundation/apache_myfaces_core.

Total CVEs

1

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

HIGH1

Vulnerabilities

Page 1 of 1

CVE-2021-26296HIGHCVSS 7.5≥ Apache MyFaces Core 2.2, < 2.2.14≥ Apache MyFaces Core 2.3, < 2.3.8+2 more2021-02-19

CVE-2021-26296 [HIGH] CWE-352 CVE-2021-26296: In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use th