Vulnerability in Oracle Mojarra

CVE-2010-4007

Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057.

Vulnerability class: POODLE (CVE-2014-3566)

EPSS: 0.010 (59.7th percentile) — read the EPSS interpretation.

Affected products

  • Oracle Mojarra — versions 1.1_02, 1.2_09, 1.2_13
  • N/a — versions n/a

Weakness classification (CWE)

References