CVE-2011-4343: Apache MyFaces Core EL Injection Vulnerability
Summary
CVE-2011-4343: Apache MyFaces Vulnerable to EL Injection. Affects org.apache.myfaces.core:myfaces-core-module across 2 version ranges.
>= 2.0.1, < 2.0.11
>= 2.1.0, < 2.1.5
Fixed in 2.0.11 or 2.1.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache MyFaces Core is a Java-based implementation of the JavaServer Faces (JSF) specification. It provides a set of APIs and components for building web applications using JSF. The vulnerability affects versions 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 of the Apache MyFaces Core module. These versions are vulnerable to an information disclosure vulnerability that allows remote attackers to inject Expression Language (EL) expressions via crafted parameters.
Vulnerability Detail
The vulnerability in Apache MyFaces Core allows remote attackers to inject EL expressions through crafted parameters. This can lead to information disclosure and potential security breaches. The vulnerability has a CVSSv3 score of 7.5, indicating a high severity level. The CWE IDs associated with this vulnerability are CWE-200 (Information Exposure) and CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement).
How To Fix
Latest published version: 4.1.4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.1, < 2.0.112.0.11 -
>= 2.1.0, < 2.1.52.1.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to a fixed version of Apache MyFaces Core.
Conclusion
The Apache MyFaces Core EL Injection vulnerability is a high severity issue that can lead to information disclosure and potential security breaches. It is recommended to upgrade to a fixed version of Apache MyFaces Core to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.myfaces.core:myfaces-core-module →
FAQ
Apache MyFaces Core is a Java-based implementation of the JavaServer Faces (JSF) specification. It provides a set of APIs and components for building web applications using JSF.
The vulnerability allows remote attackers to inject EL expressions, which can lead to information disclosure and potential security breaches.
The CVSSv3 score of this vulnerability is 7.5, indicating a high severity level.
No, only versions 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 are affected. Versions outside this range are not vulnerable.
To fix this vulnerability, upgrade to a fixed version of Apache MyFaces Core. For versions 2.0.1 through 2.0.10, upgrade to version 2.0.11 or later. For versions 2.1.0 through 2.1.4, upgrade to version 2.1.5 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.myfaces.core:myfaces-core-module.
