{"id":"CVE-2010-2057","aliases":[],"url":"https://o3.security/vulnerability/CVE-2010-2057","summary":"Improper Authentication in Apache MyFaces","details":"shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.","published":"2022-05-17T05:45:54Z","modified":"2024-12-08T05:29:13.859926Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.apache.myfaces.shared:myfaces-shared-core","fixedVersion":"1.1.8"},{"ecosystem":"Maven","name":"org.apache.myfaces.shared:myfaces-shared-core","fixedVersion":"1.2.9"},{"ecosystem":"Maven","name":"org.apache.myfaces.shared:myfaces-shared-core","fixedVersion":"2.0.1"},{"ecosystem":"Maven","name":"org.apache.myfaces.core:myfaces-impl","fixedVersion":"1.1.8"},{"ecosystem":"Maven","name":"org.apache.myfaces.core:myfaces-impl","fixedVersion":"1.2.9"},{"ecosystem":"Maven","name":"org.apache.myfaces.core:myfaces-impl","fixedVersion":"2.0.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2057"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=623799"},{"type":"WEB","url":"https://issues.apache.org/jira/browse/MYFACES-2749"},{"type":"WEB","url":"http://svn.apache.org/viewvc/myfaces/shared/trunk/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java?r1=943327&r2=951801"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-12-08T05:29:13.859926Z"}}