CVE-2010-2086 Apache MyFaces Cross-site Scripting vulnerability

What is CVE-2010-2086?

CVE-2010-2086 is a medium-severity cross-site scripting vulnerability in n/a, published on 27 May 2010. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.

Weakness: CWE-79

Which versions are affected by CVE-2010-2086?

4 open source packages ship an affected version, including org.apache.myfaces.core:myfaces-core-module. It affects 1 product.

Products include Apache Myfaces.

How do I fix CVE-2010-2086?

Upgrade to a fixed version.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2010-2086 being exploited?

There is no known exploitation of CVE-2010-2086 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2021-26296 Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces High 7.5
• CVE-2011-4343 Apache MyFaces Vulnerable to EL Injection High 7.5
• CVE-2011-4367 Apache MyFaces Vulnerable to Path Traversal Medium 5.0
• CVE-2010-2057 Improper Authentication in Apache MyFaces Medium 5.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-92cv-wv2c-8899.