Skip to content
Log inStart free trial

GHSA-j239-4gqg-5j54 CVE-2017-1000486

Inadequate Encryption Strength

Critical Known exploited Maven
Severity
9.8 / 10
Critical · CVSS 3.0
Exploit chance (EPSS)
94.10%
Chance of exploitation in the next 30 days. Higher than 99.85% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Jan 10, 2022
Weakness
CWE-326 Inadequate Encryption Strength
Fix
6.0
Upgrade org.primefaces:primefaces to this version or later
Exploited in the wild. Primetek Primefaces Remote Code Execution Vulnerability (Primetek Primefaces Application). Required action: Apply updates per vendor instructions. Due for U.S. federal agencies by Jul 10, 2022.

Description

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Affected versions

Maven

PackageVulnerableFixed in
org.primefaces:primefaces
>= 5.0, < 6.0
6.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.primefaces:primefaces Maven → 6.0

maven
<dependency><groupId>org.primefaces</groupId><artifactId>primefaces</artifactId><version>6.0</version></dependency>
gradle
implementation("org.primefaces:primefaces:6.0")

Severity breakdown

CVSS 3.0 9.8

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-326: Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

How to prevent it
  • Architecture and Design: Use an encryption scheme that is currently considered to be strong by experts in the field.

References

Advisories

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
PYSEC-2026-3765
openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and…
Critical Same weakness, CWE-326
GHSA-mwjc-5j4x-r686
AVideo has an unauthenticated decrypt oracle leaking any ciphertext
High Same weakness, CWE-326
GHSA-6m5f-j7w2-w953
AVideo has a PGP 2FA Bypass via Cryptographically Broken 512-bit RSA Key Generation in LoginControl Plugin
High Same weakness, CWE-326
GHSA-gwq6-fmvp-qp68
Microsoft Security Advisory CVE-2025-55248: .NET Information Disclosure Vulnerability
Medium Same weakness, CWE-326
GHSA-f632-9449-3j4w
Apache Tomcat - XSS in generated JSPs
Medium Same weakness, CWE-326
GHSA-qvf5-hvjx-wm27
Apache Tomcat Request and/or response mix-up
Medium Same weakness, CWE-326
GHSA-r82w-3phg-qvr4
Moodle uses the same key for QR login and auto-login
Medium Same weakness, CWE-326
GHSA-pwqm-x5x6-5586
Cilium has insecure IPsec transport encryption
Medium Same weakness, CWE-326
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor