CVE-2011-4367 Apache MyFaces Vulnerable to Path Traversal
MediumCVSS 5.0
EPSS 33.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.myfaces.core/myfaces-impl(Maven) | >= 2.0.0, < 2.0.12 | 2.0.12 |
| org.apache.myfaces.core/myfaces-impl(Maven) | >= 2.1.0, < 2.1.6 | 2.1.6 |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.0.0 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.0.1 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.0.10 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.0.11 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.0.2 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.0.3 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.0.4 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.0.5 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.0.6 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.0.7 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.0.8 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.0.9 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.1.0 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.1.1 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.1.2 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.1.3 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.1.4 | No fix listed |
| org.apache.myfaces.core/myfaces-impl(Maven) | = 2.1.5 | No fix listed |
| apache myfaces | >= 2.0.1, <= 2.0.11 | No fix listed |
| apache myfaces | >= 2.1.0, <= 2.1.5 | No fix listed |
References
- Debian Security Tracker CVE-2011-4367 vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- myfaces-in-directory-traversal(73100) third-party-advisory vdb-entry
- [myfaces-announce] 20120209 [SECURITY] CVE-2011-4367 Apache MyFaces information disclosure vulnerability exploit mailing-list vendor-advisory
- 20120209 [SECURITY] CVE-2011-4367 Apache MyFaces information disclosure vulnerability exploit mailing-list third-party-advisory
- web.archive.org
- github.com
- 79002 broken-link vdb-entry
- 47973 third-party-advisory
- 51939 exploit third-party-advisory vdb-entry