CVE-2010-2057
Improper Authentication in Apache MyFaces
shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
Exploit likelihood
What each source reports
NVD Score used
shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
- Record
CVE-2010-2057- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
- Record
CVE-2010-2057- Updated
- 2026-11-02
EUVDEUVD-2022-2370 No score
shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
- Record
EUVD-2022-2370- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4fv4-cq5v-x45m No score
Improper Authentication in Apache MyFaces
shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
- Record
GHSA-4fv4-cq5v-x45m- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-4fv4-cq5v-x45m No score
Improper Authentication in Apache MyFaces
shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
- Record
GHSA-4fv4-cq5v-x45m- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.myfaces.shared:myfaces-shared-coreMaven |
1.1.0 up to 1.1.8 | 1.1.8 |
org.apache.myfaces.shared:myfaces-shared-coreMaven |
1.2.0 up to 1.2.9 | 1.2.9 |
org.apache.myfaces.shared:myfaces-shared-coreMaven |
2.0.0 up to 2.0.1 | 2.0.1 |
org.apache.myfaces.core:myfaces-implMaven |
1.1.0 up to 1.1.8 | 1.1.8 |
org.apache.myfaces.core:myfaces-implMaven |
1.2.0 up to 1.2.9 | 1.2.9 |
org.apache.myfaces.core:myfaces-implMaven |
2.0.0 up to 2.0.1 | 2.0.1 |
org.apache.myfaces.core:myfaces-implMaven |
1.1.0 up to 1.1.8, plus listed versions 1.1.21.1.41.1.51.1.61.1.7 |
1.1.8 |
org.apache.myfaces.core:myfaces-implMaven |
1.2.0 up to 1.2.9, plus listed versions 1.2.21.2.31.2.41.2.51.2.61.2.71.2.8 |
1.2.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-2057 is a medium vulnerability (CVSS 5.0) in Apache Myfaces, published October 20, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.04%, the 87th percentile. Fixed in org.apache.myfaces.shared:myfaces-shared-core 1.1.8.