Read the docs
TI-2010-03800 Aliases CVE-2010-4007GHSA-v49c-75x7-q86w

Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC)…

Priority LOW 25CWE-310Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057.

Why it matters now

EPSS 0.01014 63rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:a:oracle:mojarra:1.1:*:*:*:*:*:*:*1.1VulnerableOracle
cpe:2.3:a:oracle:mojarra:1.1_02:*:*:*:*:*:*:*1.1_02VulnerableOracle
cpe:2.3:a:oracle:mojarra:1.2:*:*:*:*:*:*:*1.2VulnerableOracle
cpe:2.3:a:oracle:mojarra:1.2_01:*:*:*:*:*:*:*1.2_01VulnerableOracle
cpe:2.3:a:oracle:mojarra:1.2_02:*:*:*:*:*:*:*1.2_02VulnerableOracle
cpe:2.3:a:oracle:mojarra:1.2_03:*:*:*:*:*:*:*1.2_03VulnerableOracle
cpe:2.3:a:oracle:mojarra:1.2_04:*:*:*:*:*:*:*1.2_04VulnerableOracle
cpe:2.3:a:oracle:mojarra:1.2_05:*:*:*:*:*:*:*1.2_05VulnerableOracle
cpe:2.3:a:oracle:mojarra:1.2_06:*:*:*:*:*:*:*1.2_06VulnerableOracle
cpe:2.3:a:oracle:mojarra:1.2_07:*:*:*:*:*:*:*1.2_07VulnerableOracle
  • cpe:2.3:a:oracle:mojarra:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:1.1_02:*:*:*:*:*:*:* Versions 1.1_02 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:1.2_01:*:*:*:*:*:*:* Versions 1.2_01 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:1.2_02:*:*:*:*:*:*:* Versions 1.2_02 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:1.2_03:*:*:*:*:*:*:* Versions 1.2_03 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:1.2_04:*:*:*:*:*:*:* Versions 1.2_04 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:1.2_05:*:*:*:*:*:*:* Versions 1.2_05 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:1.2_06:*:*:*:*:*:*:* Versions 1.2_06 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:1.2_07:*:*:*:*:*:*:* Versions 1.2_07 Vulnerable ·Oracle
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:mojarra:1.2_08:*:*:*:*:*:*:*1.2_08VulnerableOracle
cpe:2.3:a:oracle:mojarra:1.2_09:*:*:*:*:*:*:*1.2_09VulnerableOracle
cpe:2.3:a:oracle:mojarra:1.2_10:*:*:*:*:*:*:*1.2_10VulnerableOracle
cpe:2.3:a:oracle:mojarra:1.2_11:*:*:*:*:*:*:*1.2_11VulnerableOracle
cpe:2.3:a:oracle:mojarra:1.2_12:*:*:*:*:*:*:*1.2_12VulnerableOracle
cpe:2.3:a:oracle:mojarra:1.2_13:*:*:*:*:*:*:*1.2_13VulnerableOracle
cpe:2.3:a:oracle:mojarra:1.2_14:*:*:*:*:*:*:*1.2_14VulnerableOracle
cpe:2.3:a:oracle:mojarra:1.2_15:*:*:*:*:*:*:*1.2_15VulnerableOracle
cpe:2.3:a:oracle:mojarra:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableOracle
cpe:2.3:a:oracle:mojarra:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableOracle
cpe:2.3:a:oracle:mojarra:2.0.2:*:*:*:*:*:*:*2.0.2VulnerableOracle
cpe:2.3:a:oracle:mojarra:2.0.3:*:*:*:*:*:*:*2.0.3VulnerableOracle
  • cpe:2.3:a:oracle:mojarra:1.2_08:*:*:*:*:*:*:* Versions 1.2_08 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:1.2_09:*:*:*:*:*:*:* Versions 1.2_09 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:1.2_10:*:*:*:*:*:*:* Versions 1.2_10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:1.2_11:*:*:*:*:*:*:* Versions 1.2_11 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:1.2_12:*:*:*:*:*:*:* Versions 1.2_12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:1.2_13:*:*:*:*:*:*:* Versions 1.2_13 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:1.2_14:*:*:*:*:*:*:* Versions 1.2_14 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:1.2_15:*:*:*:*:*:*:* Versions 1.2_15 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mojarra:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·Oracle

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-4007
  2. 2026-10-03 Alias added: GHSA-v49c-75x7-q86w

References

Other 2

  • TI-2013-04991 Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate… CVSS 2.0MEDIUM 4.3
  • TI-2010-01999 Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho… CVSS 2.0MEDIUM 4.3
  • TI-2012-02309 Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during… CVSS 2.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences