Read the docs
TI-2021-08130 Aliases CVE-2021-26296GHSA-gq67-pp9w-43gp

Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces

Priority LOW 38CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-352.

Summary

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.

Why it matters now

EPSS 0.02889 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Apache MyFaces Core (Apache Software Foundation): 2.2.14, 2.3.8, 2.3-next-M5 +1org.apache.myfaces.core:myfaces-core-module (Maven): 2.0.25, 2.1.19, 2.2.14 +1Red Hat: 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache MyFaces CoreApache MyFaces Core 2.2 to before 2.2.14; Apache MyFaces Core 2.3 to before 2.3.8; Apache MyFaces Core 2.3-next to before 2.3-next-M5; Apache MyFaces Core 3.0 to before 3.0.02.2.14, 2.3.8, 2.3-next-M5, 3.0.0Patch availableCNA
—org.apache.myfaces.core:myfaces-core-module (Maven)before 2.0.252.0.25Patch availableGHSA-gq67-pp9w-43gp
—org.apache.myfaces.core:myfaces-core-module (Maven)2.1.0 to before 2.1.192.1.19Patch availableGHSA-gq67-pp9w-43gp
—org.apache.myfaces.core:myfaces-core-module (Maven)2.2.0 to before 2.2.142.2.14Patch availableGHSA-gq67-pp9w-43gp
—org.apache.myfaces.core:myfaces-core-module (Maven)2.3.0 to before 2.3.82.3.8Patch availableGHSA-gq67-pp9w-43gp
  • Apache MyFaces Core VendorApache Affected Apache MyFaces Core 2.2 to before 2.2.14; Apache MyFaces Core 2.3 to before 2.3.8; Apache MyFaces Core 2.3-next to before 2.3-next-M5; Apache MyFaces Core 3.0 to before 3.0.0 Fixed in 2.2.14, 2.3.8, 2.3-next-M5, 3.0.0 Patch available CNA
  • org.apache.myfaces.core:myfaces-core-module (Maven) Vendor— Affected before 2.0.25 Fixed in 2.0.25 Patch available GHSA-gq67-pp9w-43gp
  • org.apache.myfaces.core:myfaces-core-module (Maven) Vendor— Affected 2.1.0 to before 2.1.19 Fixed in 2.1.19 Patch available GHSA-gq67-pp9w-43gp
  • org.apache.myfaces.core:myfaces-core-module (Maven) Vendor— Affected 2.2.0 to before 2.2.14 Fixed in 2.2.14 Patch available GHSA-gq67-pp9w-43gp
  • org.apache.myfaces.core:myfaces-core-module (Maven) Vendor— Affected 2.3.0 to before 2.3.8 Fixed in 2.3.8 Patch available GHSA-gq67-pp9w-43gp

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:apache:myfaces:*:*:*:*:*:*:*:*2.2.0 – 2.2.13; 2.3.0 – 2.3.7VulnerableApache
cpe:2.3:a:apache:myfaces:2.3:next-m1:*:*:*:*:*:*2.3 next-m1VulnerableApache
cpe:2.3:a:apache:myfaces:2.3:next-m2:*:*:*:*:*:*2.3 next-m2VulnerableApache
cpe:2.3:a:apache:myfaces:2.3:next-m3:*:*:*:*:*:*2.3 next-m3VulnerableApache
cpe:2.3:a:apache:myfaces:2.3:next-m4:*:*:*:*:*:*2.3 next-m4VulnerableApache
cpe:2.3:a:apache:myfaces:3.0.0:rc1:*:*:*:*:*:*3.0.0 rc1VulnerableApache
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:apache:myfaces:*:*:*:*:*:*:*:* Versions 2.2.0 – 2.2.13; 2.3.0 – 2.3.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:myfaces:2.3:next-m1:*:*:*:*:*:* Versions 2.3 next-m1 Vulnerable ·Apache
  • cpe:2.3:a:apache:myfaces:2.3:next-m2:*:*:*:*:*:* Versions 2.3 next-m2 Vulnerable ·Apache
  • cpe:2.3:a:apache:myfaces:2.3:next-m3:*:*:*:*:*:* Versions 2.3 next-m3 Vulnerable ·Apache
  • cpe:2.3:a:apache:myfaces:2.3:next-m4:*:*:*:*:*:* Versions 2.3 next-m4 Vulnerable ·Apache
  • cpe:2.3:a:apache:myfaces:3.0.0:rc1:*:*:*:*:*:* Versions 3.0.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · CNA Apache MyFaces Core (Apache Software Foundation) Fixed in 2.2.14, 2.3.8, 2.3-next-M5, 3.0.0
  • Fix · GHSA-gq67-pp9w-43gp org.apache.myfaces.core:myfaces-core-module (Maven) Fixed in 2.0.25 Advisory →
  • Fix · GHSA-gq67-pp9w-43gp org.apache.myfaces.core:myfaces-core-module (Maven) Fixed in 2.1.19 Advisory →
  • Fix · GHSA-gq67-pp9w-43gp org.apache.myfaces.core:myfaces-core-module (Maven) Fixed in 2.2.14 Advisory →
  • Fix · GHSA-gq67-pp9w-43gp org.apache.myfaces.core:myfaces-core-module (Maven) Fixed in 2.3.8 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Decision Manager 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Not affected: 2 products
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-26296
  2. 2026-10-03 Alias added: GHSA-gq67-pp9w-43gp

References

Exploit 1

Advisory 4

Other 3

  • TI-2011-03829 Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache… CVSS 2.0MEDIUM 5.0
  • TI-2011-03808 Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and… CVSS 3.0HIGH 7.5
  • TI-2010-01972 shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and… CVSS 2.0MEDIUM 5.0
  • TI-2010-01998 Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other… CVSS 2.0MEDIUM 4.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences