Security Advisory
CVE-2016-5019
9.8
CRITICAL
Vulnerability Description
CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized view state string.
Published Date
October 3, 2016
Official Source
NIST NVD Advisory