Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2021-26296

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.008
EPSS Ranking 73.1%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.1
Products affected by CVE-2021-26296
  • Apache » Myfaces » Version: 2.2.0
    cpe:2.3:a:apache:myfaces:2.2.0
  • Apache » Myfaces » Version: 2.2.1
    cpe:2.3:a:apache:myfaces:2.2.1
  • Apache » Myfaces » Version: 2.2.10
    cpe:2.3:a:apache:myfaces:2.2.10
  • Apache » Myfaces » Version: 2.2.11
    cpe:2.3:a:apache:myfaces:2.2.11
  • Apache » Myfaces » Version: 2.2.12
    cpe:2.3:a:apache:myfaces:2.2.12
  • Apache » Myfaces » Version: 2.2.13
    cpe:2.3:a:apache:myfaces:2.2.13
  • Apache » Myfaces » Version: 2.2.2
    cpe:2.3:a:apache:myfaces:2.2.2
  • Apache » Myfaces » Version: 2.2.3
    cpe:2.3:a:apache:myfaces:2.2.3
  • Apache » Myfaces » Version: 2.2.4
    cpe:2.3:a:apache:myfaces:2.2.4
  • Apache » Myfaces » Version: 2.2.5
    cpe:2.3:a:apache:myfaces:2.2.5
  • Apache » Myfaces » Version: 2.2.6
    cpe:2.3:a:apache:myfaces:2.2.6
  • Apache » Myfaces » Version: 2.2.7
    cpe:2.3:a:apache:myfaces:2.2.7
  • Apache » Myfaces » Version: 2.2.8
    cpe:2.3:a:apache:myfaces:2.2.8
  • Apache » Myfaces » Version: 2.2.9
    cpe:2.3:a:apache:myfaces:2.2.9
  • Apache » Myfaces » Version: 2.3
    cpe:2.3:a:apache:myfaces:2.3
  • Apache » Myfaces » Version: 2.3.0
    cpe:2.3:a:apache:myfaces:2.3.0
  • Apache » Myfaces » Version: 2.3.1
    cpe:2.3:a:apache:myfaces:2.3.1
  • Apache » Myfaces » Version: 2.3.2
    cpe:2.3:a:apache:myfaces:2.3.2
  • Apache » Myfaces » Version: 2.3.3
    cpe:2.3:a:apache:myfaces:2.3.3
  • Apache » Myfaces » Version: 2.3.4
    cpe:2.3:a:apache:myfaces:2.3.4
  • Apache » Myfaces » Version: 2.3.5
    cpe:2.3:a:apache:myfaces:2.3.5
  • Apache » Myfaces » Version: 2.3.6
    cpe:2.3:a:apache:myfaces:2.3.6
  • Apache » Myfaces » Version: 2.3.7
    cpe:2.3:a:apache:myfaces:2.3.7
  • Apache » Myfaces » Version: 3.0.0
    cpe:2.3:a:apache:myfaces:3.0.0
  • Netapp » Oncommand Insight » Version: N/A
    cpe:2.3:a:netapp:oncommand_insight:-


Products
Pricing
Contact Us

Shodan ® - All rights reserved