CVE-2010-2087

Published May 27, 2010

Last updated 12 years ago

Overview

Description: Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
Source: cve@mitre.org
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 4.3
Impact score: 2.9
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:N/I:P/A:N

Weaknesses

nvd@nist.gov: CWE-79

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:caucho:resin:*:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "5ACDA2C2-4331-4687-80EF-E1F59EDAFA49"
          },
          {
            "criteria": "cpe:2.3:a:ibm:websphere_application_server:*:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "0F30E314-888C-42AE-A173-7C002500B4D4"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:oracle:mojarra:1.2_14:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B0EE32A1-5581-4609-8ED0-541C64E4F4AD"
          },
          {
            "criteria": "cpe:2.3:a:oracle:mojarra:2.0.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B61EBC64-67E8-48FB-85B6-FBDDC4792152"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References