Security Advisory

CVE-2010-2086

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2010-05-27 18:32:00

Last updated 2024-09-17 02:36:44

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.

← Browse all CVEs View on cve.org ↗