GHSA-x7rc-4gqw-3q6q

Source

https://github.com/advisories/GHSA-x7rc-4gqw-3q6q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-x7rc-4gqw-3q6q/GHSA-x7rc-4gqw-3q6q.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x7rc-4gqw-3q6q

Aliases

CVE-2016-5019

Published

2022-05-13T01:25:19Z

Modified

2024-02-16T08:20:54.208889Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache MyFaces Trinidad Deserialization Vulnerability

Details

CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized viewstate string.

Database specific

{
    "nvd_published_at": "2016-10-03T18:59:00Z",
    "cwe_ids": [
        "CWE-502"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-31T18:20:06Z"
}

References

Affected packages

Maven / org.apache.myfaces.trinidad:trinidad

Package

Name: org.apache.myfaces.trinidad:trinidad; View open source insights on deps.dev
Purl: pkg:maven/org.apache.myfaces.trinidad/trinidad

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.0.0

Last affected

1.0.13

Affected versions

1.*

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.0.11

1.0.12

1.0.13

Maven / org.apache.myfaces.trinidad:trinidad

Package

Name: org.apache.myfaces.trinidad:trinidad; View open source insights on deps.dev
Purl: pkg:maven/org.apache.myfaces.trinidad/trinidad

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.2.0

Fixed

1.2.15

Affected versions

1.*

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

1.2.10

1.2.11

1.2.12

1.2.13

1.2.14

Maven / org.apache.myfaces.trinidad:trinidad

Package

Name: org.apache.myfaces.trinidad:trinidad; View open source insights on deps.dev
Purl: pkg:maven/org.apache.myfaces.trinidad/trinidad

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.0.0

Fixed

2.0.2

Affected versions

2.*

2.0.0

2.0.1

Maven / org.apache.myfaces.trinidad:trinidad

Package

Name: org.apache.myfaces.trinidad:trinidad; View open source insights on deps.dev
Purl: pkg:maven/org.apache.myfaces.trinidad/trinidad

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.1.0

Fixed

2.1.2

Affected versions

2.*

2.1.0

2.1.1