Java JSF ViewState Deserialization
JavaServer Faces (JSF) may store view state in the client through the javax.faces.ViewState parameter. If the application accepts an unauthenticated serialized state without effective integrity protection, a crafted object graph can reach gadget classes on the server’s classpath and lead to code execution during deserialization. Exploitability depends on the JSF implementation, its state-saving configuration, cryptographic protection, and available gadgets.[1]
The first reference explains the affected configurations and mitigations. The second walks through a practical assessment in which exposed configuration material enabled a protected ViewState to be reproduced.[1][2]