CVE-2011-4343

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=full-disclosure&m=132313252814362Third Party Advisory
http://www.securitytracker.com/id/1039695
https://issues.apache.org/jira/secure/attachment/12504807/MYFACES-3405-1.patchPatch, Vendor Advisory
http://marc.info/?l=full-disclosure&m=132313252814362Third Party Advisory
http://www.securitytracker.com/id/1039695
https://issues.apache.org/jira/secure/attachment/12504807/MYFACES-3405-1.patchPatch, Vendor Advisory

Timeline

Published: Aug 8, 2017
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-43442.6Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone conta CVE-2011-43452.6Cross-site scripting (XSS) vulnerability in Namazu before 2.0.21, when Internet Explorer 6 or 7 is used, allows remote attackers to inject a CVE-2011-43464.6Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite allows remote authenticated users to inject CVE-2011-43474.0The kvm_vm_ioctl_assign_device function in virt/kvm/assigned-dev.c in the KVM subsystem in the Linux kernel before 3.1.10 does not verify pe CVE-2011-43487.1Race condition in the sctp_rcv function in net/sctp/input.c in the Linux kernel before 2.6.29 allows remote attackers to cause a denial of s CVE-2011-43494.6Multiple SQL injection vulnerabilities in (1) cd-mapping-db.c and (2) cd-device-db.c in colord before 0.1.15 allow local users to execute ar CVE-2011-43506.5Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user could use this flaw to CVE-2011-43517.5Buffer overflow in FFmpeg before 0.5.6, 0.6.x before 0.6.4, 0.7.x before 0.7.8, and 0.8.x before 0.8.8 allows remote attackers to execute ar CVE-2011-43526.8Integer overflow in the vp3_dequant function in the VP3 decoder (vp3.c) in libavcodec in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.CVE-2011-43534.3The (1) av_image_fill_pointers, (2) vp5_parse_coeff, and (3) vp6_parse_coeff functions in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7 CVE-2011-43545.8crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving CVE-2011-43556.9GNU Project Debugger (GDB) before 7.5, when .debug_gdb_scripts is defined, automatically loads certain files from the current working direct