Cross-Site Scripting Vulnerability in Oracle Mojarra for IBM WebSphere and Caucho Resin
CVE-2010-2087

Currently unrated

Key Information:

Vendor
Oracle
Status
Mojarra
Vendor
CVE Published:
27 May 2010

Summary

The Oracle Mojarra library, utilized in applications like IBM WebSphere Application Server and Caucho Resin, has a vulnerability that fails to securely handle unencrypted view states. This flaw allows remote attackers to exploit the serialized view object, potentially leading to cross-site scripting (XSS) attacks or executing unauthorized Expression Language (EL) statements. Proper precautions must be taken to safeguard against these exploitation vectors.

References

https://www.trustwave.com/spiderlabs/advisories/TWSL2010-...
x_refsource_MISC
http://www.blackhat.com/presentations/bh-dc-10/Byrne_Davi...
x_refsource_MISC

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.