{"id":"CVE-2016-5019","description":"CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized view state string.","cvssScore":9.8,"cvssVersion":"3.0","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssMetrics":[{"version":"3.0","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"}],"cwes":["CWE-502"],"resolved":"MITIGATED-BY-RASP","published":"2016-10-03","lastModified":"2026-06-17","affectedProducts":[{"vendor":"apache","product":"myfaces trinidad","versionStart":"\u003e=1.0.0","versionEnd":"\u003c1.0.13"},{"vendor":"apache","product":"myfaces trinidad","versionStart":"\u003e=1.2.0","versionEnd":"\u003c1.2.15"},{"vendor":"apache","product":"myfaces trinidad","versionStart":"\u003e=2.0.0","versionEnd":"\u003c2.0.2"},{"vendor":"apache","product":"myfaces trinidad","versionStart":"\u003e=2.1.0","versionEnd":"\u003c2.1.2"}],"totalAffectedProducts":1,"references":[{"url":"https://github.com/apache/myfaces-trinidad","source":"osv","tags":["PACKAGE"]},{"url":"https://issues.apache.org/jira/browse/TRINIDAD-2542","source":"osv","tags":["WEB"]},{"url":"https://web.archive.org/web/20171129092136/http://www.securitytracker.com/id/1037633","source":"osv","tags":["WEB"]},{"url":"https://web.archive.org/web/20210123173557/http://www.securityfocus.com/bid/93236","source":"osv","tags":["WEB"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","source":"osv","tags":["WEB"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","source":"osv","tags":["WEB"]},{"url":"http://mail-archives.apache.org/mod_mbox/myfaces-users/201609.mbox/%3CCAM1yOjYM%2BEW3mLUfX0pNAVLfUFRAw-Bhvkp3UE5%3DEQzR8Yxsfw%40mail.gmail.com%3E","source":"osv","tags":["WEB"]},{"url":"http://packetstormsecurity.com/files/138920/Apache-MyFaces-Trinidad-Information-Disclosure.html","source":"osv","tags":["WEB"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","source":"osv","tags":["WEB"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","source":"osv","tags":["WEB"]}],"reasoning":{"decidingSource":"secure-rule-match","decidingReason":"Promoted to MITIGATED-BY-RASP (security rule): this CVE's weakness (CWE-502: Deserialization of Untrusted Data) can be mitigated by an ARMR deserialization security rule that blocks this class of attack at the JVM level, without requiring a CVE-specific patch.","verdicts":[{"rule":"rejected","stage":"identity","outcome":"no-match"},{"rule":"armr-patch-file","stage":"scope","outcome":"no-match"},{"rule":"armr-secure-rule-file","stage":"scope","outcome":"no-match"},{"rule":"manual-classification","stage":"scope","outcome":"no-match"},{"rule":"h2-history","stage":"scope","outcome":"no-match"},{"rule":"non-java-upstream","stage":"scope","outcome":"no-match"},{"rule":"oracle-component","stage":"scope","outcome":"no-match"},{"rule":"osv-maven","stage":"scope","outcome":"matched","status":"QUEUED-FOR-REVIEW","detail":"Maven packages: org.apache.myfaces.trinidad:trinidad"},{"rule":"patch-hint","stage":"disposition","outcome":"no-match"},{"rule":"open-source-maven","stage":"disposition","outcome":"matched","status":"MITIGATION-CANDIDATE","detail":"Open-source Maven artifact indexed by OSV (Maven packages: org.apache.myfaces.trinidad:trinidad). The source is public, which makes an ARMR patch rule a candidate; nothing here establishes that one can be written."},{"rule":"poc-derivable","stage":"disposition","outcome":"skipped"},{"rule":"no-exploit","stage":"disposition","outcome":"skipped"},{"rule":"secure-rule-match","stage":"disposition","outcome":"matched","status":"MITIGATED-BY-RASP","detail":"CWE-502 (Deserialization of Untrusted Data) is mitigable by an ARMR deserialization security rule.","decisive":true},{"rule":"below-action-threshold","stage":"disposition","outcome":"skipped"},{"rule":"no-exploit-published","stage":"disposition","outcome":"skipped"}],"affectedProducts":[{"vendor":"apache","product":"myfaces_trinidad","isKnown":false,"cpe":"cpe:2.3:a:apache:myfaces_trinidad:*:*:*:*:*:*:*:*"}],"affectedPackages":[{"name":"org.apache.myfaces.trinidad:trinidad","introduced":"1.0.0","lastAffected":"1.0.13"},{"name":"org.apache.myfaces.trinidad:trinidad","introduced":"1.2.0","fixed":"1.2.15"},{"name":"org.apache.myfaces.trinidad:trinidad","introduced":"2.0.0","fixed":"2.0.2"},{"name":"org.apache.myfaces.trinidad:trinidad","introduced":"2.1.0","fixed":"2.1.2"}]},"oracleAdvisories":[{"advisory":"Oracle Critical Patch Update July 2020","releaseType":"CPU","quarter":"2020-Q3","url":"https://www.oracle.com/security-alerts/cpujul2020.html","products":[{"product":"Oracle Supply Chain","component":"Middle Tier (Apache Trinidad)","affectedVersions":"12.1, 12.2"}]},{"advisory":"Oracle Critical Patch Update January 2020","releaseType":"CPU","quarter":"2020-Q1","url":"https://www.oracle.com/security-alerts/cpujan2020.html","products":[{"product":"Oracle Retail Applications","component":"Dataset Component (Apache Trinidad)","affectedVersions":"13.4"},{"product":"Oracle Retail Applications","component":"General Application (Apache Trinidad)","affectedVersions":"14.0.3"}]},{"advisory":"Oracle Critical Patch Update October 2018","releaseType":"CPU","quarter":"2018-Q4","url":"https://www.oracle.com/security-alerts/cpuoct2018.html","products":[{"product":"Oracle Communications Applications","component":"Security (Apache Trinidad)","affectedVersions":"Prior to 10.2.1"}]},{"advisory":"Oracle Critical Patch Update July 2018","releaseType":"CPU","quarter":"2018-Q3","url":"https://www.oracle.com/security-alerts/cpujul2018.html","products":[{"product":"Oracle Utilities Applications","component":"Help (Apache Trinidad)","affectedVersions":"4.3.x"}]},{"advisory":"Oracle Critical Patch Update April 2018","releaseType":"CPU","quarter":"2018-Q2","url":"https://www.oracle.com/security-alerts/cpuapr2018.html","products":[{"product":"Oracle Fusion Middleware","component":"Tile Server (Apache MyFaces Trinidad)","affectedVersions":"11.1.1.7.0, 11.1.1.9.0"}]},{"advisory":"Oracle Critical Patch Update October 2017","releaseType":"CPU","quarter":"2017-Q4","url":"https://www.oracle.com/security-alerts/cpuoct2017.html","products":[{"product":"Oracle Communications Applications","component":"Security (Apache Trinidad)","affectedVersions":"5.1, 6.0"}]},{"advisory":"Oracle Critical Patch Update July 2017","releaseType":"CPU","quarter":"2017-Q3","url":"https://www.oracle.com/security-alerts/cpujul2017.html","products":[{"product":"Oracle Primavera Products Suite","component":"Web Access (Apache Trinidad)","affectedVersions":"8.3, 8.4, 15.1, 15.2"}]},{"advisory":"Oracle Critical Patch Update April 2017","releaseType":"CPU","quarter":"2017-Q2","url":"https://www.oracle.com/security-alerts/cpuapr2017.html","products":[{"product":"Oracle Sun Systems Products Suite","component":"Core (Apache Trinidad)","affectedVersions":"Prior to 2.2.1"},{"product":"Oracle Utilities Applications","component":"Packaging (Apache Trinidad)","affectedVersions":"2.1.0.2.0"}]},{"advisory":"Oracle Critical Patch Update January 2017","releaseType":"CPU","quarter":"2017-Q1","url":"https://www.oracle.com/security-alerts/cpujan2017.html","products":[{"product":"Oracle Enterprise Manager Grid Control","component":"Application Testing Suite","affectedVersions":"12.5.0.3"},{"product":"Oracle Enterprise Manager Grid Control","component":"Enterprise Manager Base Platform","affectedVersions":"12.1.0.5, 13.1, 13.2"}]}],"assessment":{"record":{"state":"active"},"protection":{"level":"full","mechanisms":["security-rule"]},"action":{"state":"available","type":"security-rule"},"review":{"state":"automated","basis":"inferred"}},"signals":{"hasPOC":false,"pocCount":0},"kev":{"inKEV":false},"epss":{"available":true,"score":0.07958,"percentile":0.94412},"ssvc":{"available":false}}