GitHub Advisoryadvisory · Maven

GHSA-43q7-q5vp-3g68 Path Traversal in Eclipse Mojarra

HIGH Published 2022-05-14 Modified 2022-11-03 Official page ↗
Aliases
CVE-2018-14371
Ecosystem
Maven
Packages
org.glassfish:mojarra-parent
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2022-11-03

Affected packages

• Maven org.glassfish:mojarra-parent: < 2.3.7 → fixed in 2.3.7

Description

The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.

Related

Alias · CVE (1)

  • CVE-2018-14371 The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References