CVE-2021-26296

Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces

HIGH

7.5

CVSS Score

Published: February 19, 2021 at 08:30 AM UTC

Updated: June 17, 2026 at 03:43 AM UTC

2 products affected across 2 vendorsOnCommand InsightMyfaces

Using Apache MyFaces Core by Apache Software Foundation?

Get instant alerts when new vulnerabilities affect Apache MyFaces Core - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 3%

Description

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Myfaces · Apachemaven

95%

2.2.0 ≤ v ≤ 2.2.132.3.0 ≤ v ≤ 2.3.7Apache MyFaces Core 2.2 ≤ v < 2.2.14Apache MyFaces Core 2.3 ≤ v < 2.3.8Apache MyFaces Core 2.3-next ≤ v < 2.3-next-M5Apache MyFaces Core 3.0 ≤ v < 3.0.02.2 2.32.3 next-m12.3 next-m2 2.3 next-m3 2.3 next-m4 2.3-next 3.0 3.0.0 rc1

Affected range stops below 2.2.14, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.3-next-M5, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.3.8, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.0.0, so it looks safe — our inference, not a vendor statement

OnCommand Insight · NetAppdrupal

95%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://lists.apache.org/thread.html/r2b73e2356c6155e9ec78fdd8f72a4fac12f3e588014f5f535106ed9b%40%3Cannounce.apache.org%3E

References (4)

x_refsource_MISCExploitThird Party AdvisoryVDB Entry

Source: [email protected]

http://packetstormsecurity.com/files/161484/Apache-MyFaces-2.x-Cross-Site-Request-Forgery.html

Mailing Listx_refsource_FULLDISCThird Party Advisory

Source: [email protected]

http://seclists.org/fulldisclosure/2021/Feb/66

x_refsource_MISCMailing ListVendor Advisory

Source: [email protected]

https://lists.apache.org/thread.html/r2b73e2356c6155e9ec78fdd8f72a4fac12f3e588014f5f535106ed9b%40%3Cannounce.apache.org%3E

x_refsource_CONFIRMThird Party Advisory

Source: [email protected]

https://security.netapp.com/advisory/ntap-20210528-0007/

CVSS

7.5HIGH[email protected]

Attack Vector: NETWORK
Complexity: HIGH
Privileges: NONE
User Interaction: REQUIRED
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-352

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card