CVE:CVE-2010-4007
CNNVD:CNNVD-201010-326
Oracle Mojarra使用不带消息认证代码(MAC)的加密View State。远程攻击者更容易借助填充oracle攻击成功的修改View State的值。
solution:Upgrade oracle mojarra to a higher version than 1.1,1.1_02,1.2,1.2_01,1.2_02,1.2_03,1.2_04,1.2_05,1.2_06,1.2_07,1.2_08,1.2_09,1.2_10,1.2_11,1.2_12,1.2_13,1.2_14,1.2_15,2.0.0,2.0.1,2.0.2,2.0.3,and avoid the version 1.1,1.1_02,1.2,1.2_01,1.2_02,1.2_03,1.2_04,1.2_05,1.2_06,1.2_07,1.2_08,1.2_09,1.2_10,1.2_11,1.2_12,1.2_13,1.2_14,1.2_15,2.0.0,2.0.1,2.0.2,2.0.3