Riskcovery

CVE-2021-26296

Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces

State
Published
Severity
Not scored
Published
Feb 19, 2021
Updated
Feb 13, 2025
Reserved
Jan 28, 2021

Read the record on cve.org

Description

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

ProductVersions
Apache MyFaces CoreApache Software Foundation
  • Apache MyFaces Core 2.2 to before 2.2.14Affected
  • Apache MyFaces Core 2.3 to before 2.3.8Affected
  • Apache MyFaces Core 2.3-next to before 2.3-next-M5Affected
  • Apache MyFaces Core 3.0 to before 3.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.