CVE-2010-4007

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-10-20 · updated 2026-06-16
Weakness: CWE-310

Description

Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057.

Affected products

Oracle Mojarra: 1.1, 1.1_02, 1.2, 1.2_01, 1.2_02, 1.2_03 (+16)

References

https://bugzilla.redhat.com/show_bug.cgi?id=623799
https://issues.apache.org/jira/browse/MYFACES-2749
https://bugzilla.redhat.com/show_bug.cgi?id=623799
https://issues.apache.org/jira/browse/MYFACES-2749

Get alerted when CVE-2010-4007 or the next vulnerability affects your stack