Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Apache MyFaces 'shared/util/StateUtils.java'加密问题漏洞
Vulnerability Description
Apache MyFaces是美国阿帕奇（Apache）软件基金会的一个项目，它实现了JavaServer Faces（JSF，一个用于构建Web应用程序的标准Java框架）。 Apache MyFaces 1.1.8之前的1.1.x版本，1.2.9之前的1.2.x版本，以及2.0.1之前的2.0.x版本中的shared/util/StateUtils.java文件使用了不带消息认证代码(MAC)的加密View State。远程攻击者更容易借助填充oracle攻击执行View State的成功修改。
CVSS Information
N/A
Vulnerability Type
N/A