View State Vulnerability in Oracle Mojarra Products
CVE-2010-4007

Currently unrated

Key Information:

Vendor
Oracle
Status
Mojarra
Vendor
CVE Published:
20 October 2010

Summary

Oracle Mojarra has a notable vulnerability characterized by its use of an encrypted View State lacking a Message Authentication Code (MAC). This flaw can allow remote attackers to successfully manipulate the View State through a padding oracle attack. Such an attack enables unauthorized modifications, posing significant risks to application integrity and data confidentiality. Insights from related vulnerabilities highlight the need for comprehensive security measures in software development to mitigate similar exploits.

References

https://bugzilla.redhat.com/show_bug.cgi?id=623799
x_refsource_MISC
https://issues.apache.org/jira/browse/MYFACES-2749
x_refsource_MISC

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.