Apache Software Foundation MyFaces 2.3.7

CPE Details

Apache Software Foundation MyFaces 2.3.7
apache
myfaces
2.3.7
2021-02-22
16h31 +00:00
2021-02-22
16h31 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:apache:myfaces:2.3.7:*:*:*:*:*:*:*

Informations

Vendor

apache

Product

myfaces

Version

2.3.7

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2021-26296 2021-02-19 08h30 +00:00 In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.
7.5
High