GHSA-jq6g-p65r-44xr

Apache MyFaces Vulnerable to EL Injection

Source: GitHub Advisory Database (reviewed) High CVE-2011-4343

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.myfaces.core:myfaces-core-module	>= 2.0.1, < 2.0.11	2.0.11
Maven	org.apache.myfaces.core:myfaces-core-module	>= 2.1.0, < 2.1.5	2.1.5

Details

As written in the advisory (Markdown source, shown as plain text).

Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2011-4343 advisory
https://github.com/apache/myfaces/commit/a74b551b2ce6e88101ff453389a761f230e428a1 web
https://github.com/apache/myfaces/commit/caee86e71ab8c5f038186158e9955887ed72a0fd web
https://github.com/apache/myfaces package
https://issues.apache.org/jira/secure/attachment/12504807/MYFACES-3405-1.patch web
http://marc.info/?l=full-disclosure&m=132313252814362 web