Every CVE Search/ Get API key

CVE-2010-2086

Apache MyFaces Cross-site Scripting vulnerability

4.0 MediumFix available

Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.

Exploit likelihood

2.12%Up 1.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.0

Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.

Record
CVE-2010-2086
CVSS 2.0
4.0 MediumAV:N/AC:H/Au:N/C:P/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.

Record
CVE-2010-2086
Updated
2026-11-02
EUVDEUVD-2022-3270 No score

Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.

Record
EUVD-2022-3270
Updated
2026-11-03
GitHub AdvisoriesGHSA-92cv-wv2c-8899 No score

Apache MyFaces Cross-site Scripting vulnerability

Apache MyFaces 1.1.7 and 1.2.8 (All previous versions are likely vulnerable), as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.

Record
GHSA-92cv-wv2c-8899
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-92cv-wv2c-8899 No score

Apache MyFaces Cross-site Scripting vulnerability

Apache MyFaces 1.1.7 and 1.2.8 (All previous versions are likely vulnerable), as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.

Record
GHSA-92cv-wv2c-8899
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.myfaces.core:myfaces-core-module
Maven
 through 1.1.7 None known
org.apache.myfaces.core:myfaces-core-module
Maven
 1.2.0 to 1.2.8 None known
glassfish-jsf
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:1.2_13-2.ep5.el4
0:1.2_13-2.ep5.el4
httpd22
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.14-4.ep5.el4
0:2.2.14-4.ep5.el4
httpd22-apr
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.14-4.ep5.el4
0:2.2.14-4.ep5.el4
httpd22-apr-devel
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.14-4.ep5.el4
0:2.2.14-4.ep5.el4
httpd22-apr-util
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.14-4.ep5.el4
0:2.2.14-4.ep5.el4
httpd22-apr-util-devel
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.14-4.ep5.el4
0:2.2.14-4.ep5.el4
httpd22-debuginfo
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.14-4.ep5.el4
0:2.2.14-4.ep5.el4
httpd22-devel
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.14-4.ep5.el4
0:2.2.14-4.ep5.el4
Show 79 moreShow less
Affected packages
PackageAffectedFixed
httpd22-manual
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.2.14-4.ep5.el4
0:2.2.14-4.ep5.el4
jakarta-commons-chain
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:1.2-2.1.ep5.el4
0:1.2-2.1.ep5.el4
jakarta-commons-digester
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:1.8.1-7.ep5.el4
0:1.8.1-7.ep5.el4
jakarta-commons-io
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:1.4-1.ep5.el4
0:1.4-1.ep5.el4
jakarta-commons-modeler
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.0-3.3.ep5.el4
0:2.0-3.3.ep5.el4
jakarta-commons-validator
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:1.3.1-7.4.ep5.el4
0:1.3.1-7.4.ep5.el4
jakarta-oro
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.0.8-3jpp.ep1.3.ep5.el4
0:2.0.8-3jpp.ep1.3.ep5.el4
jboss-javaee
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:5.0.1-2.3.ep5.el4
0:5.0.1-2.3.ep5.el4
jboss-javaee-poms
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:5.0.1-2.3.ep5.el4
0:5.0.1-2.3.ep5.el4
jboss-transaction-1.0.1-api
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:5.0.1-2.3.ep5.el4
0:5.0.1-2.3.ep5.el4
mod_jk
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:1.2.28-4.ep5.el4
0:1.2.28-4.ep5.el4
mod_jk-ap20
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:1.2.28-4.ep5.el4
0:1.2.28-4.ep5.el4
mod_jk-debuginfo
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:1.2.28-4.ep5.el4
0:1.2.28-4.ep5.el4
mod_jk-manual
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:1.2.28-4.ep5.el4
0:1.2.28-4.ep5.el4
mod_ssl22
Red Hat:jboss_enterprise_web_server:1::el4
 before 1:2.2.14-4.ep5.el4
1:2.2.14-4.ep5.el4
struts12
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:1.2.9-2.ep5.el4
0:1.2.9-2.ep5.el4
tomcat-native
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:1.1.19-2.0.ep5.el4
0:1.1.19-2.0.ep5.el4
tomcat-native-debuginfo
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:1.1.19-2.0.ep5.el4
0:1.1.19-2.0.ep5.el4
tomcat5
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:5.5.28-7.ep5.el4
0:5.5.28-7.ep5.el4
tomcat5-admin-webapps
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:5.5.28-7.ep5.el4
0:5.5.28-7.ep5.el4
tomcat5-common-lib
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:5.5.28-7.ep5.el4
0:5.5.28-7.ep5.el4
tomcat5-jasper
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:5.5.28-7.ep5.el4
0:5.5.28-7.ep5.el4
tomcat5-jasper-eclipse
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:5.5.28-7.ep5.el4
0:5.5.28-7.ep5.el4
tomcat5-jasper-javadoc
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:5.5.28-7.ep5.el4
0:5.5.28-7.ep5.el4
tomcat5-jsp-2.0-api
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:5.5.28-7.ep5.el4
0:5.5.28-7.ep5.el4
tomcat5-jsp-2.0-api-javadoc
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:5.5.28-7.ep5.el4
0:5.5.28-7.ep5.el4
tomcat5-parent
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:5.5.28-7.ep5.el4
0:5.5.28-7.ep5.el4
tomcat5-server-lib
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:5.5.28-7.ep5.el4
0:5.5.28-7.ep5.el4
tomcat5-servlet-2.4-api
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:5.5.28-7.ep5.el4
0:5.5.28-7.ep5.el4
tomcat5-servlet-2.4-api-javadoc
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:5.5.28-7.ep5.el4
0:5.5.28-7.ep5.el4
tomcat5-webapps
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:5.5.28-7.ep5.el4
0:5.5.28-7.ep5.el4
tomcat6
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:6.0.24-2.ep5.el4
0:6.0.24-2.ep5.el4
tomcat6-admin-webapps
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:6.0.24-2.ep5.el4
0:6.0.24-2.ep5.el4
tomcat6-docs-webapp
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:6.0.24-2.ep5.el4
0:6.0.24-2.ep5.el4
tomcat6-el-1.0-api
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:6.0.24-2.ep5.el4
0:6.0.24-2.ep5.el4
tomcat6-javadoc
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:6.0.24-2.ep5.el4
0:6.0.24-2.ep5.el4
tomcat6-jsp-2.1-api
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:6.0.24-2.ep5.el4
0:6.0.24-2.ep5.el4
tomcat6-lib
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:6.0.24-2.ep5.el4
0:6.0.24-2.ep5.el4
tomcat6-log4j
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:6.0.24-2.ep5.el4
0:6.0.24-2.ep5.el4
tomcat6-servlet-2.5-api
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:6.0.24-2.ep5.el4
0:6.0.24-2.ep5.el4
tomcat6-webapps
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:6.0.24-2.ep5.el4
0:6.0.24-2.ep5.el4
xerces-j2
Red Hat:jboss_enterprise_web_server:1::el4
 before 0:2.9.1-2.2_patch_01.ep5.el4
0:2.9.1-2.2_patch_01.ep5.el4
xml-commons-resolver12
Red Hat:jboss_enterprise_web_server:1::el4
 before 1:1.2-1.1.ep5.el4
1:1.2-1.1.ep5.el4
glassfish-jsf
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:1.2_13-3.ep5.el5
0:1.2_13-3.ep5.el5
httpd
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:2.2.14-1.2.1.ep5.el5
0:2.2.14-1.2.1.ep5.el5
httpd-devel
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:2.2.14-1.2.1.ep5.el5
0:2.2.14-1.2.1.ep5.el5
httpd-manual
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:2.2.14-1.2.1.ep5.el5
0:2.2.14-1.2.1.ep5.el5
jakarta-commons-chain
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:1.2-2.1.1.ep5.el5
0:1.2-2.1.1.ep5.el5
jakarta-commons-io
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:1.4-1.1.ep5.el5
0:1.4-1.1.ep5.el5
jakarta-oro
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:2.0.8-3.1.ep5.el5
0:2.0.8-3.1.ep5.el5
mod_jk
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:1.2.28-4.1.ep5.el5
0:1.2.28-4.1.ep5.el5
mod_jk-ap20
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:1.2.28-4.1.ep5.el5
0:1.2.28-4.1.ep5.el5
mod_jk-manual
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:1.2.28-4.1.ep5.el5
0:1.2.28-4.1.ep5.el5
mod_ssl
Red Hat:jboss_enterprise_web_server:1::el5
 before 1:2.2.14-1.2.1.ep5.el5
1:2.2.14-1.2.1.ep5.el5
struts12
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:1.2.9-2.ep5.el5
0:1.2.9-2.ep5.el5
tomcat-native
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:1.1.19-2.0.1.ep5.el5
0:1.1.19-2.0.1.ep5.el5
tomcat5
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.28-7.1.ep5.el5
0:5.5.28-7.1.ep5.el5
tomcat5-admin-webapps
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.28-7.1.ep5.el5
0:5.5.28-7.1.ep5.el5
tomcat5-common-lib
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.28-7.1.ep5.el5
0:5.5.28-7.1.ep5.el5
tomcat5-jasper
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.28-7.1.ep5.el5
0:5.5.28-7.1.ep5.el5
tomcat5-jasper-eclipse
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.28-7.1.ep5.el5
0:5.5.28-7.1.ep5.el5
tomcat5-jasper-javadoc
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.28-7.1.ep5.el5
0:5.5.28-7.1.ep5.el5
tomcat5-jsp-2.0-api
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.28-7.1.ep5.el5
0:5.5.28-7.1.ep5.el5
tomcat5-jsp-2.0-api-javadoc
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.28-7.1.ep5.el5
0:5.5.28-7.1.ep5.el5
tomcat5-parent
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.28-7.1.ep5.el5
0:5.5.28-7.1.ep5.el5
tomcat5-server-lib
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.28-7.1.ep5.el5
0:5.5.28-7.1.ep5.el5
tomcat5-servlet-2.4-api
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.28-7.1.ep5.el5
0:5.5.28-7.1.ep5.el5
tomcat5-servlet-2.4-api-javadoc
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.28-7.1.ep5.el5
0:5.5.28-7.1.ep5.el5
tomcat5-webapps
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.28-7.1.ep5.el5
0:5.5.28-7.1.ep5.el5
tomcat6
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.24-2.1.ep5.el5
0:6.0.24-2.1.ep5.el5
tomcat6-admin-webapps
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.24-2.1.ep5.el5
0:6.0.24-2.1.ep5.el5
tomcat6-docs-webapp
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.24-2.1.ep5.el5
0:6.0.24-2.1.ep5.el5
tomcat6-el-1.0-api
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.24-2.1.ep5.el5
0:6.0.24-2.1.ep5.el5
tomcat6-javadoc
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.24-2.1.ep5.el5
0:6.0.24-2.1.ep5.el5
tomcat6-jsp-2.1-api
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.24-2.1.ep5.el5
0:6.0.24-2.1.ep5.el5
tomcat6-lib
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.24-2.1.ep5.el5
0:6.0.24-2.1.ep5.el5
tomcat6-log4j
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.24-2.1.ep5.el5
0:6.0.24-2.1.ep5.el5
tomcat6-servlet-2.5-api
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.24-2.1.ep5.el5
0:6.0.24-2.1.ep5.el5
tomcat6-webapps
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.24-2.1.ep5.el5
0:6.0.24-2.1.ep5.el5

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2010-2086 is a medium vulnerability (CVSS 4.0) in Apache Myfaces, published May 27, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.12%, the 81st percentile. Fixed in glassfish-jsf 0:1.2_13-2.ep5.el4.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open