CVE-2011-4343: Infoleak
Published Aug 8, 2017
·Updated
Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.
Affected Software
17 affected componentsFixes available
Apache MyFaces=2.0.10
Apache MyFaces=2.0.8
Apache MyFaces=2.0.4
Apache MyFaces=2.0.7
Apache MyFaces=2.1.0
Apache MyFaces=2.0.2
Apache MyFaces=2.0.1
Apache MyFaces=2.1.1
Apache MyFaces=2.1.3
Apache MyFaces=2.1.4
Apache MyFaces=2.0.3
Apache MyFaces=2.0.9
Apache MyFaces=2.1.2
Apache MyFaces=2.0.5
Apache MyFaces=2.0.6
maven/org.apache.myfaces.core:myfaces-core-module>=2.1.0<=2.1.4
2.1.5
maven/org.apache.myfaces.core:myfaces-core-module>=2.0.1<=2.0.10
2.0.11
Remediation
Event History
Aug 8, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
May 17, 2022
Advisory Published
via GitHub·12:29 AM
Frequently Asked Questions
1
What is the severity of CVE-2011-4343?
CVE-2011-4343 is classified as an information disclosure vulnerability that may allow remote attackers to inject malicious EL expressions.
2
How do I fix CVE-2011-4343?
To remediate CVE-2011-4343, upgrade Apache MyFaces Core to version 2.1.5 or 2.0.11.
3
What versions are affected by CVE-2011-4343?
CVE-2011-4343 affects Apache MyFaces Core versions from 2.0.1 to 2.0.10 and 2.1.0 to 2.1.4.
4
Is CVE-2011-4343 specific to any application?
CVE-2011-4343 specifically impacts applications that utilize affected versions of Apache MyFaces Core.
5
What are the consequences of CVE-2011-4343 being exploited?
Exploitation of CVE-2011-4343 could lead to unauthorized access to sensitive information through code injection.