CVE-2010-2086
Apache MyFaces Cross-site Scripting vulnerability
4.0 Medium
Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
Exploit likelihood
2.12%Up 1.1 points since Feb 4, 2022
What each source reports
NVD Score used
Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
- Record
CVE-2010-2086- CVSS 2.0
- 4.0 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
- Record
CVE-2010-2086- Updated
- 2026-11-02
EUVDEUVD-2022-3270 No score
Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
- Record
EUVD-2022-3270- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-92cv-wv2c-8899 No score
Apache MyFaces Cross-site Scripting vulnerability
Apache MyFaces 1.1.7 and 1.2.8 (All previous versions are likely vulnerable), as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
- Record
GHSA-92cv-wv2c-8899- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-92cv-wv2c-8899 No score
Apache MyFaces Cross-site Scripting vulnerability
Apache MyFaces 1.1.7 and 1.2.8 (All previous versions are likely vulnerable), as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
- Record
GHSA-92cv-wv2c-8899- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.myfaces.core:myfaces-core-moduleMaven |
through 1.1.7 | None known |
org.apache.myfaces.core:myfaces-core-moduleMaven |
1.2.0 to 1.2.8 | None known |
glassfish-jsfRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:1.2_13-2.ep5.el4 | 0:1.2_13-2.ep5.el4 |
httpd22Red Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:2.2.14-4.ep5.el4 | 0:2.2.14-4.ep5.el4 |
httpd22-aprRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:2.2.14-4.ep5.el4 | 0:2.2.14-4.ep5.el4 |
httpd22-apr-develRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:2.2.14-4.ep5.el4 | 0:2.2.14-4.ep5.el4 |
httpd22-apr-utilRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:2.2.14-4.ep5.el4 | 0:2.2.14-4.ep5.el4 |
httpd22-apr-util-develRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:2.2.14-4.ep5.el4 | 0:2.2.14-4.ep5.el4 |
httpd22-debuginfoRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:2.2.14-4.ep5.el4 | 0:2.2.14-4.ep5.el4 |
httpd22-develRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:2.2.14-4.ep5.el4 | 0:2.2.14-4.ep5.el4 |
Show 79 moreShow less
| Package | Affected | Fixed |
|---|---|---|
httpd22-manualRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:2.2.14-4.ep5.el4 | 0:2.2.14-4.ep5.el4 |
jakarta-commons-chainRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:1.2-2.1.ep5.el4 | 0:1.2-2.1.ep5.el4 |
jakarta-commons-digesterRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:1.8.1-7.ep5.el4 | 0:1.8.1-7.ep5.el4 |
jakarta-commons-ioRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:1.4-1.ep5.el4 | 0:1.4-1.ep5.el4 |
jakarta-commons-modelerRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:2.0-3.3.ep5.el4 | 0:2.0-3.3.ep5.el4 |
jakarta-commons-validatorRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:1.3.1-7.4.ep5.el4 | 0:1.3.1-7.4.ep5.el4 |
jakarta-oroRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:2.0.8-3jpp.ep1.3.ep5.el4 | 0:2.0.8-3jpp.ep1.3.ep5.el4 |
jboss-javaeeRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:5.0.1-2.3.ep5.el4 | 0:5.0.1-2.3.ep5.el4 |
jboss-javaee-pomsRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:5.0.1-2.3.ep5.el4 | 0:5.0.1-2.3.ep5.el4 |
jboss-transaction-1.0.1-apiRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:5.0.1-2.3.ep5.el4 | 0:5.0.1-2.3.ep5.el4 |
mod_jkRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:1.2.28-4.ep5.el4 | 0:1.2.28-4.ep5.el4 |
mod_jk-ap20Red Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:1.2.28-4.ep5.el4 | 0:1.2.28-4.ep5.el4 |
mod_jk-debuginfoRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:1.2.28-4.ep5.el4 | 0:1.2.28-4.ep5.el4 |
mod_jk-manualRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:1.2.28-4.ep5.el4 | 0:1.2.28-4.ep5.el4 |
mod_ssl22Red Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 1:2.2.14-4.ep5.el4 | 1:2.2.14-4.ep5.el4 |
struts12Red Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:1.2.9-2.ep5.el4 | 0:1.2.9-2.ep5.el4 |
tomcat-nativeRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:1.1.19-2.0.ep5.el4 | 0:1.1.19-2.0.ep5.el4 |
tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:1.1.19-2.0.ep5.el4 | 0:1.1.19-2.0.ep5.el4 |
tomcat5Red Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:5.5.28-7.ep5.el4 | 0:5.5.28-7.ep5.el4 |
tomcat5-admin-webappsRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:5.5.28-7.ep5.el4 | 0:5.5.28-7.ep5.el4 |
tomcat5-common-libRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:5.5.28-7.ep5.el4 | 0:5.5.28-7.ep5.el4 |
tomcat5-jasperRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:5.5.28-7.ep5.el4 | 0:5.5.28-7.ep5.el4 |
tomcat5-jasper-eclipseRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:5.5.28-7.ep5.el4 | 0:5.5.28-7.ep5.el4 |
tomcat5-jasper-javadocRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:5.5.28-7.ep5.el4 | 0:5.5.28-7.ep5.el4 |
tomcat5-jsp-2.0-apiRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:5.5.28-7.ep5.el4 | 0:5.5.28-7.ep5.el4 |
tomcat5-jsp-2.0-api-javadocRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:5.5.28-7.ep5.el4 | 0:5.5.28-7.ep5.el4 |
tomcat5-parentRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:5.5.28-7.ep5.el4 | 0:5.5.28-7.ep5.el4 |
tomcat5-server-libRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:5.5.28-7.ep5.el4 | 0:5.5.28-7.ep5.el4 |
tomcat5-servlet-2.4-apiRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:5.5.28-7.ep5.el4 | 0:5.5.28-7.ep5.el4 |
tomcat5-servlet-2.4-api-javadocRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:5.5.28-7.ep5.el4 | 0:5.5.28-7.ep5.el4 |
tomcat5-webappsRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:5.5.28-7.ep5.el4 | 0:5.5.28-7.ep5.el4 |
tomcat6Red Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:6.0.24-2.ep5.el4 | 0:6.0.24-2.ep5.el4 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:6.0.24-2.ep5.el4 | 0:6.0.24-2.ep5.el4 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:6.0.24-2.ep5.el4 | 0:6.0.24-2.ep5.el4 |
tomcat6-el-1.0-apiRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:6.0.24-2.ep5.el4 | 0:6.0.24-2.ep5.el4 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:6.0.24-2.ep5.el4 | 0:6.0.24-2.ep5.el4 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:6.0.24-2.ep5.el4 | 0:6.0.24-2.ep5.el4 |
tomcat6-libRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:6.0.24-2.ep5.el4 | 0:6.0.24-2.ep5.el4 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:6.0.24-2.ep5.el4 | 0:6.0.24-2.ep5.el4 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:6.0.24-2.ep5.el4 | 0:6.0.24-2.ep5.el4 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:6.0.24-2.ep5.el4 | 0:6.0.24-2.ep5.el4 |
xerces-j2Red Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 0:2.9.1-2.2_patch_01.ep5.el4 | 0:2.9.1-2.2_patch_01.ep5.el4 |
xml-commons-resolver12Red Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 4 CVEs |
before 1:1.2-1.1.ep5.el4 | 1:1.2-1.1.ep5.el4 |
glassfish-jsfRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:1.2_13-3.ep5.el5 | 0:1.2_13-3.ep5.el5 |
httpdRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:2.2.14-1.2.1.ep5.el5 | 0:2.2.14-1.2.1.ep5.el5 |
httpd-develRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:2.2.14-1.2.1.ep5.el5 | 0:2.2.14-1.2.1.ep5.el5 |
httpd-manualRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:2.2.14-1.2.1.ep5.el5 | 0:2.2.14-1.2.1.ep5.el5 |
jakarta-commons-chainRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:1.2-2.1.1.ep5.el5 | 0:1.2-2.1.1.ep5.el5 |
jakarta-commons-ioRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:1.4-1.1.ep5.el5 | 0:1.4-1.1.ep5.el5 |
jakarta-oroRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:2.0.8-3.1.ep5.el5 | 0:2.0.8-3.1.ep5.el5 |
mod_jkRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:1.2.28-4.1.ep5.el5 | 0:1.2.28-4.1.ep5.el5 |
mod_jk-ap20Red Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:1.2.28-4.1.ep5.el5 | 0:1.2.28-4.1.ep5.el5 |
mod_jk-manualRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:1.2.28-4.1.ep5.el5 | 0:1.2.28-4.1.ep5.el5 |
mod_sslRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 1:2.2.14-1.2.1.ep5.el5 | 1:2.2.14-1.2.1.ep5.el5 |
struts12Red Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:1.2.9-2.ep5.el5 | 0:1.2.9-2.ep5.el5 |
tomcat-nativeRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:1.1.19-2.0.1.ep5.el5 | 0:1.1.19-2.0.1.ep5.el5 |
tomcat5Red Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:5.5.28-7.1.ep5.el5 | 0:5.5.28-7.1.ep5.el5 |
tomcat5-admin-webappsRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:5.5.28-7.1.ep5.el5 | 0:5.5.28-7.1.ep5.el5 |
tomcat5-common-libRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:5.5.28-7.1.ep5.el5 | 0:5.5.28-7.1.ep5.el5 |
tomcat5-jasperRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:5.5.28-7.1.ep5.el5 | 0:5.5.28-7.1.ep5.el5 |
tomcat5-jasper-eclipseRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:5.5.28-7.1.ep5.el5 | 0:5.5.28-7.1.ep5.el5 |
tomcat5-jasper-javadocRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:5.5.28-7.1.ep5.el5 | 0:5.5.28-7.1.ep5.el5 |
tomcat5-jsp-2.0-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:5.5.28-7.1.ep5.el5 | 0:5.5.28-7.1.ep5.el5 |
tomcat5-jsp-2.0-api-javadocRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:5.5.28-7.1.ep5.el5 | 0:5.5.28-7.1.ep5.el5 |
tomcat5-parentRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:5.5.28-7.1.ep5.el5 | 0:5.5.28-7.1.ep5.el5 |
tomcat5-server-libRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:5.5.28-7.1.ep5.el5 | 0:5.5.28-7.1.ep5.el5 |
tomcat5-servlet-2.4-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:5.5.28-7.1.ep5.el5 | 0:5.5.28-7.1.ep5.el5 |
tomcat5-servlet-2.4-api-javadocRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:5.5.28-7.1.ep5.el5 | 0:5.5.28-7.1.ep5.el5 |
tomcat5-webappsRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:5.5.28-7.1.ep5.el5 | 0:5.5.28-7.1.ep5.el5 |
tomcat6Red Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:6.0.24-2.1.ep5.el5 | 0:6.0.24-2.1.ep5.el5 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:6.0.24-2.1.ep5.el5 | 0:6.0.24-2.1.ep5.el5 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:6.0.24-2.1.ep5.el5 | 0:6.0.24-2.1.ep5.el5 |
tomcat6-el-1.0-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:6.0.24-2.1.ep5.el5 | 0:6.0.24-2.1.ep5.el5 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:6.0.24-2.1.ep5.el5 | 0:6.0.24-2.1.ep5.el5 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:6.0.24-2.1.ep5.el5 | 0:6.0.24-2.1.ep5.el5 |
tomcat6-libRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:6.0.24-2.1.ep5.el5 | 0:6.0.24-2.1.ep5.el5 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:6.0.24-2.1.ep5.el5 | 0:6.0.24-2.1.ep5.el5 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:6.0.24-2.1.ep5.el5 | 0:6.0.24-2.1.ep5.el5 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 4 CVEs |
before 0:6.0.24-2.1.ep5.el5 | 0:6.0.24-2.1.ep5.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-2086 is a medium vulnerability (CVSS 4.0) in Apache Myfaces, published May 27, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.12%, the 81st percentile. No source names a fixed version.
References
trustwave.com/spiderlabs/advisories/TWSL2010-001.txt
blackhat.com/presentations/bh-dc-10/Byrne_David/BlackHat-DC-2010-Byrne-SGUI-slides.pdf
nvd.nist.gov/vuln/detail/CVE-2010-2086
github.com/advisories/GHSA-92cv-wv2c-8899
access.redhat.com/errata/RHSA-2010:0119
Show 21 moreShow less
kbase.redhat.com/faq/docs/DOC-20491
redhat.com/docs/en-US/JBoss_Enterprise_Web_Server/1.0.1/html-single/Release_Notes/index.html
bugzilla.redhat.com/show_bug.cgi?id=533125
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0119.json
cve.org/CVERecord?id=CVE-2009-2693