CVE-2010-2057
The MITRE CVE dictionary describes this issue as:
shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
Find out more about CVE-2010-2057 from the MITRE CVE dictionary dictionary and NIST NVD.
Statement
Not vulnerable. This issue did not affect the versions of myfaces as shipped with JBoss Enterprise Web Server.
CVSS v2 metrics
NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.
| Base Score | 4.3 |
|---|---|
| Base Metrics | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| Access Vector | Network |
| Access Complexity | Medium |
| Authentication | None |
| Confidentiality Impact | None |
| Integrity Impact | Partial |
| Availability Impact | None |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat JBoss EWS 1 | Other | Will not fix |
| Red Hat JBoss EWS 1 | httpd | Will not fix |
CVE description copyright © 2017, The MITRE Corporation