GitHub Advisoryadvisory · Maven

GHSA-gjfx-9wx3-j6r7 Apache MyFaces Vulnerable to Path Traversal

MEDIUM Published 2022-05-13 Modified 2023-08-16 Official page ↗
Aliases
CVE-2011-4367
Ecosystem
Maven
Packages
org.apache.myfaces.core:myfaces-impl
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2022-11-02

Affected packages

• Maven org.apache.myfaces.core:myfaces-impl: >= 2.0.0, < 2.0.12 → fixed in 2.0.12 • Maven org.apache.myfaces.core:myfaces-impl: >= 2.1.0, < 2.1.6 → fixed in 2.1.6

Description

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a `..` (dot dot) in the (1) ln parameter to `faces/javax.faces.resource/web.xml` or (2) the `PATH_INFO` to `faces/javax.faces.resource/`.

Related

Alias · CVE (1)

  • CVE-2011-4367 Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References