Vulnerability	Vulnerable Version
H Missing Authorization Affected versions of this package are vulnerable to Missing Authorization via the `CombinedResourceInfo` process. An attacker can cause excessive memory consumption and potentially exhaust server resources by submitting forged combined-resource IDs that inflate to large outputs and are cached without bounds. Additional attack vectors include bypassing resource boundaries to access raw content, triggering server-side requests to attacker-controlled hosts, polluting source-map caches, injecting unescaped values into Ajax callback scripts, and replaying push-channel messages to unauthorized clients by exploiting insufficient session binding. How to fix Missing Authorization? Upgrade `org.omnifaces:omnifaces` to version 1.14.3, 2.7.33, 3.14.23, 4.7.12, 5.4.2 or higher.	[,1.14.3)[2.0-RC1,2.7.33)[3.0-RC1,3.14.23)[4.0-M1,4.7.12)[5.0-M1,5.4.2)

Missing Authorization

Affected versions of this package are vulnerable to Missing Authorization via the CombinedResourceInfo process. An attacker can cause excessive memory consumption and potentially exhaust server resources by submitting forged combined-resource IDs that inflate to large outputs and are cached without bounds. Additional attack vectors include bypassing resource boundaries to access raw content, triggering server-side requests to attacker-controlled hosts, polluting source-map caches, injecting unescaped values into Ajax callback scripts, and replaying push-channel messages to unauthorized clients by exploiting insufficient session binding.

How to fix Missing Authorization?

Upgrade org.omnifaces:omnifaces to version 1.14.3, 2.7.33, 3.14.23, 4.7.12, 5.4.2 or higher.

[,1.14.3)[2.0-RC1,2.7.33)[3.0-RC1,3.14.23)[4.0-M1,4.7.12)[5.0-M1,5.4.2)

Go back to all versions of this package