XSS in Caucho Resin
CVE-2010-2087
Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.015 (71.7th percentile) — read the EPSS interpretation.
Affected products
- Caucho Resin
- Ibm Websphere_application_server
- Oracle Mojarra — versions 2.0.2, 1.2_14
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (Exploit, x_refsource_MISC)