CVE-2016-5019: Critical severity apache myfaces vulnerability
CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized viewstate string.
Other sources
CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized view state string.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5019?
CVE-2016-5019 is classified as a medium severity vulnerability.
How do I fix CVE-2016-5019?
To fix CVE-2016-5019, upgrade Apache MyFaces Trinidad to version 1.2.15, 2.0.2, or 2.1.2 or later.
What type of attack does CVE-2016-5019 allow?
CVE-2016-5019 allows attackers to conduct deserialization attacks via a crafted serialized viewstate string.
Which versions of Apache MyFaces Trinidad are affected by CVE-2016-5019?
CVE-2016-5019 affects Apache MyFaces Trinidad versions from 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2.
Is CVE-2016-5019 related to any specific software component?
CVE-2016-5019 is related to the CoreResponseStateManager component in Apache MyFaces Trinidad.