ID CVE-2010-4007
Summary Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057.
References
Vulnerable Configurations
  • cpe:2.3:a:oracle:mojarra:1.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.1_02:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.1_02:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.2_01:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.2_01:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.2_02:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.2_02:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.2_03:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.2_03:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.2_04:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.2_04:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.2_05:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.2_05:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.2_06:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.2_06:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.2_07:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.2_07:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.2_08:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.2_08:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.2_09:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.2_09:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.2_10:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.2_10:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.2_11:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.2_11:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.2_12:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.2_12:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.2_13:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.2_13:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.2_14:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.2_14:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:1.2_15:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:1.2_15:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:2.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:2.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:2.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:2.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:2.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:2.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mojarra:2.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:oracle:mojarra:2.0.3:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 21-10-2010 - 04:00)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:P/A:N
refmap via4
misc
Last major update 21-10-2010 - 04:00
Published 20-10-2010 - 18:00
Last modified 21-10-2010 - 04:00
Back to Top