CVE-2010-2086: XSS
Apache MyFaces 1.1.7 and 1.2.8 (All previous versions are likely vulnerable), as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
Other sources
Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2086?
CVE-2010-2086 has a high severity rating due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2010-2086?
To fix CVE-2010-2086, upgrade to Apache MyFaces version 1.2.9 or later, where the vulnerability has been resolved.
Which versions of Apache MyFaces are affected by CVE-2010-2086?
CVE-2010-2086 affects Apache MyFaces versions 1.1.7 and 1.2.8, along with all previous versions.
What types of attacks does CVE-2010-2086 enable?
CVE-2010-2086 enables remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary expressions.
What applications are impacted by CVE-2010-2086?
Applications such as IBM WebSphere Application Server that utilize Apache MyFaces versions 1.1.7 and 1.2.8 are impacted by CVE-2010-2086.