peter bassill · operator
$ cve CVE-2016-5019 JSON

CVE-2016-5019

9.8
CRITICAL · CVSS 3.0 · EPSS 8% (pctl 95)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized view state string.

Scoring

CVSS9.8 (CRITICAL, v3.0)
VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS7.96% — more likely to be exploited than 95% of all CVEs
WeaknessCWE-502
On CISA KEVno
Public exploitnone known
Published2016-10-03
Last modified2026-06-17

Affected (1)

VendorProduct
apachemyfaces trinidad

References

→ the Explorer  ·  watch your stack  ·  NVD