CVE-2021-26296 Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces

What is CVE-2021-26296?

CVE-2021-26296 is a high-severity vulnerability in Netapp Oncommand Insight, published on 19 Feb 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.

Weakness: CWE-352

Which versions are affected by CVE-2021-26296?

8 open source packages ship an affected version, including org.apache.myfaces.core:myfaces-core-module. It affects 2 products.

Products include Apache Myfaces, Netapp Oncommand Insight.

How do I fix CVE-2021-26296?

Upgrade org.apache.myfaces.core:myfaces-core-module to a fixed version for your release line: 2.0.25, 2.1.19, 2.2.14 or 2.3.8.

Is CVE-2021-26296 being exploited?

There is no known exploitation of CVE-2021-26296 in the wild and no public exploit code.

Other vulnerabilities in Netapp Oncommand Insight

• CVE-2011-4343 Apache MyFaces Vulnerable to EL Injection High 7.5
• CVE-2011-4367 Apache MyFaces Vulnerable to Path Traversal Medium 5.0
• CVE-2010-2057 Improper Authentication in Apache MyFaces Medium 5.0
• CVE-2010-2086 Apache MyFaces Cross-site Scripting vulnerability Medium 4.0

All Netapp Oncommand Insight vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gq67-pp9w-43gp.