CVE-2021-26296CWE-352

CVE-2021-26296: falha em Apache MyFaces Core

Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache MyFaces Core+ Monitorar org.apache.myfaces.core:myfaces-core-module

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 2.9%
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.
Produtos afetados
Apache Software Foundation · Apache MyFaces Core