Description
Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.myfaces.core:myfaces-core-module | >= 2.0.1, < 2.0.11 | 2.0.11 | GHSA-jq6g-p65r-44xr |
| Maven | org.apache.myfaces.core:myfaces-core-module | >= 2.1.0, < 2.1.5 | 2.1.5 | GHSA-jq6g-p65r-44xr |