{"id":"CVE-2010-2057","aliases":["EUVD-2022-2370","GHSA-4fv4-cq5v-x45m"],"status":"published","title":"Improper Authentication in Apache MyFaces","description":"shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0304,"percentile":0.8761,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-310"],"published":"2010-10-20T17:00:00Z","modified":"2026-06-16T23:19:53Z","fixes":[{"ecosystem":"Maven","package":"org.apache.myfaces.shared:myfaces-shared-core","fixed_in":["1.1.8","1.2.9","2.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.myfaces.core:myfaces-impl","fixed_in":["1.1.8","1.2.9","2.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.myfaces.shared:myfaces-shared-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.myfaces.shared:myfaces-shared-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.9"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.myfaces.shared:myfaces-shared-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.myfaces.core:myfaces-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.myfaces.core:myfaces-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.9"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.myfaces.core:myfaces-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.myfaces.shared:myfaces-shared-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.8"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.myfaces.shared:myfaces-shared-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.9"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.myfaces.shared:myfaces-shared-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}]}],"versions":["2.0.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.myfaces.core:myfaces-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.0"},{"fixed":"1.1.8"}]}],"versions":["1.1.2","1.1.4","1.1.5","1.1.6","1.1.7"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.myfaces.core:myfaces-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.0"},{"fixed":"1.2.9"}]}],"versions":["1.2.0","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.myfaces.core:myfaces-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}]}],"versions":["2.0.0"]}],"products":[{"vendor":"apache","product":"myfaces"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=623799","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://issues.apache.org/jira/browse/MYFACES-2749","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc/myfaces/shared/trunk/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java?r1=943327\u0026r2=951801","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2057","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4fv4-cq5v-x45m"}],"sources":{"cve":[{"id":"CVE-2010-2057","description":"shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.","status":"published","published":"2010-10-20T17:00:00Z","modified":"2024-08-07T02:17:14.378Z","updated_at":"2026-11-02T14:33:27.01833Z"}],"euvd":[{"id":"EUVD-2022-2370","description":"shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.","status":"published","published":"2010-10-20T17:00:00Z","modified":"2024-08-07T02:17:14Z","updated_at":"2026-11-03T01:39:38.920426Z"}],"ghsa":[{"id":"GHSA-4fv4-cq5v-x45m","title":"Improper Authentication in Apache MyFaces","description":"shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.","status":"published","published":"2022-05-17T05:45:54Z","modified":"2023-09-26T16:25:04Z","cwes":["CWE-287"],"updated_at":"2026-11-02T14:37:06.234371Z"}],"nvd":[{"id":"CVE-2010-2057","description":"shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.","status":"published","published":"2010-10-20T18:00:02.503Z","modified":"2026-06-16T23:19:53.927Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:01:57.065463Z"}],"osv":[{"id":"GHSA-4fv4-cq5v-x45m","title":"Improper Authentication in Apache MyFaces","description":"shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.","status":"published","published":"2022-05-17T05:45:54Z","modified":"2024-12-08T05:29:13.859926Z","cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:36.782754Z"}]}}