high7.5
CVE-2011-4343
Apache MyFaces Vulnerable to EL Injection
Impact
Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.myfaces.core:myfaces-core-module | >= 2.0.1, <= 2.0.10 | 2.0.11 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Myfaces | Versions 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://marc.info/?l=full-disclosure&m=132313252814362
- http://www.securitytracker.com/id/1039695
- https://issues.apache.org/jira/secure/attachment/12504807/MYFACES-3405-1.patch
- https://github.com/advisories/GHSA-jq6g-p65r-44xr
- https://nvd.nist.gov/vuln/detail/CVE-2011-4343
- https://github.com/apache/myfaces/commit/a74b551b2ce6e88101ff453389a761f230e428a1
- https://github.com/apache/myfaces/commit/caee86e71ab8c5f038186158e9955887ed72a0fd