Log in Start free

Vulnerability · Published Feb 19, 2021 · Assigned by apache

CVE-2021-26296Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces

High 7.5

In plain English

A high-severity cross-site request forgery in Apache MyFaces Core from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.9%top 13.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.myfaces.core:myfaces-core-module2.0.25GHSA-gq67-pp9w-43gp
Mavenorg.apache.myfaces.core:myfaces-core-module2.1.19GHSA-gq67-pp9w-43gp
Mavenorg.apache.myfaces.core:myfaces-core-module2.2.14GHSA-gq67-pp9w-43gp
Mavenorg.apache.myfaces.core:myfaces-core-module2.3.8GHSA-gq67-pp9w-43gp

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache MyFaces Core Apache MyFaces Core 2.2 – before 2.2.14Apache MyFaces Core 2.3 – before 2.3.8Apache MyFaces Core 2.3-next – before 2.3-next-M5Apache MyFaces Core 3.0 – before 3.0.0

Weakness: CWE-352

References