CVE Catalog
CVE-2016-5019
CriticalSummary
CoreResponseStateManager in Apache MyFaces Trinidad versions 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 may allow attackers to conduct deserialization attacks via a crafted serialized view state string.
Risk Assessment
Deserialization attacks may lead to unauthorized code execution, posing a significant threat to application security and user data.
Recommendation
It is recommended to update Apache MyFaces Trinidad to the latest version to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized view state string.