NetSight
IP …
high7.5

CVE-2021-26296

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically wea…

Impact

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.

Affected products

VendorProductAffected versions
ApacheMyfaces
from 2.2.0 through 2.2.13
from 2.3.0 through 2.3.7
Versions 2.3, 3.0.0
NetappOncommand Insight
All versions

Weakness classification

CWE-352

References