CVE-2010-2087: XSS
Oracle Mojarra 1.214 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2087?
CVE-2010-2087 is considered a high severity vulnerability due to its potential for cross-site scripting and arbitrary code execution.
How do I fix CVE-2010-2087?
To fix CVE-2010-2087, upgrade Oracle Mojarra to version 2.0.3 or later, or apply relevant patches from your software vendor.
Which applications are affected by CVE-2010-2087?
CVE-2010-2087 affects Oracle Mojarra versions 1.2_14 and 2.0.2, as well as applications using these versions including IBM WebSphere Application Server and Caucho Resin.
Can CVE-2010-2087 lead to data breaches?
Yes, CVE-2010-2087 can lead to data breaches through cross-site scripting attacks and execution of arbitrary code, potentially exposing sensitive information.
Is CVE-2010-2087 specific to certain configurations?
CVE-2010-2087 is not specific to configurations; it affects the vulnerable versions of Oracle Mojarra regardless of application setup.