CVE-2011-4343

Опубликовано: 08 авг. 2017

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.

Ссылки

http://marc.info/?l=full-disclosure&m=132313252814362
Third Party Advisory
http://www.securitytracker.com/id/1039695
https://issues.apache.org/jira/secure/attachment/12504807/MYFACES-3405-1.patch
Patch
Vendor Advisory
http://marc.info/?l=full-disclosure&m=132313252814362
Third Party Advisory
http://www.securitytracker.com/id/1039695
https://issues.apache.org/jira/secure/attachment/12504807/MYFACES-3405-1.patch
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:myfaces:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:myfaces:2.0.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:myfaces:2.0.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:myfaces:2.0.4:*:*:*:*:*:*:*

cpe:2.3:a:apache:myfaces:2.0.5:*:*:*:*:*:*:*

cpe:2.3:a:apache:myfaces:2.0.6:*:*:*:*:*:*:*

cpe:2.3:a:apache:myfaces:2.0.7:*:*:*:*:*:*:*

cpe:2.3:a:apache:myfaces:2.0.8:*:*:*:*:*:*:*

cpe:2.3:a:apache:myfaces:2.0.9:*:*:*:*:*:*:*

cpe:2.3:a:apache:myfaces:2.0.10:*:*:*:*:*:*:*

cpe:2.3:a:apache:myfaces:2.1.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:myfaces:2.1.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:myfaces:2.1.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:myfaces:2.1.3:*:*:*:*:*:*:*

cpe:2.3:a:apache:myfaces:2.1.4:*:*:*:*:*:*:*

EPSS

Процентиль: 75%

0.00864

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2011-4343

redhat

около 14 лет назад