Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.
References
Link | Resource |
---|---|
http://marc.info/?l=full-disclosure&m=132313252814362 | Third Party Advisory |
http://www.securitytracker.com/id/1039695 | |
https://issues.apache.org/jira/secure/attachment/12504807/MYFACES-3405-1.patch | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2017-08-08 21:29
Updated : 2024-02-04 19:29
NVD link : CVE-2011-4343
Mitre link : CVE-2011-4343
CVE.ORG link : CVE-2011-4343
JSON object : View
Products Affected
apache
- myfaces
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor