Oracle Mojarra Encrypted View State Oracle Padding Security Vulnerability
BID:44337
Info
Oracle Mojarra Encrypted View State Oracle Padding Security Vulnerability
| Bugtraq ID: | 44337 |
| Class: | Design Error |
| CVE: |
CVE-2010-4007 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 22 2010 12:00AM |
| Updated: | Oct 22 2010 12:00AM |
| Credit: | Leonardo Uribe |
| Vulnerable: |
Oracle Mojarra 0 |
| Not Vulnerable: | |
Discussion
Oracle Mojarra Encrypted View State Oracle Padding Security Vulnerability
Oracle Mojarra is prone to a vulnerability that may allow attackers to modify the 'View State' through padding oracle attacks.
Successful exploits will allow attackers to modify the 'View State'. This may result in the disclosure of potentially sensitive information.
Oracle Mojarra is prone to a vulnerability that may allow attackers to modify the 'View State' through padding oracle attacks.
Successful exploits will allow attackers to modify the 'View State'. This may result in the disclosure of potentially sensitive information.
Exploit / POC
Oracle Mojarra Encrypted View State Oracle Padding Security Vulnerability
To exploit this issue, an attacker must entice an unsuspecting user to view a maliciously crafted web document.
To exploit this issue, an attacker must entice an unsuspecting user to view a maliciously crafted web document.
Solution / Fix
Oracle Mojarra Encrypted View State Oracle Padding Security Vulnerability
Solution:
Currently we are not aware of any vendor supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Oracle Mojarra Encrypted View State Oracle Padding Security Vulnerability
References:
References: