What’s Vulnerable › Vulnerabilities

CVE-2011-4343

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-08-08 · updated 2026-06-16
• Weakness: CWE-200

Description

Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.

Affected products

• Apache Myfaces: 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6 (+9)

References

• http://marc.info/?l=full-disclosure&m=132313252814362
• http://www.securitytracker.com/id/1039695
• https://issues.apache.org/jira/secure/attachment/12504807/MYFACES-3405-1.patch
• http://marc.info/?l=full-disclosure&m=132313252814362
• http://www.securitytracker.com/id/1039695
• https://issues.apache.org/jira/secure/attachment/12504807/MYFACES-3405-1.patch

Get alerted when CVE-2011-4343 or the next vulnerability affects your stack