Apache MyFaces Vulnerable to Path Traversal

MEDIUM 5.0CVE-2011-4367 · GHSA-gjfx-9wx3-j6r7 · Published 19/06/2014 · updated 16/06/2026

Package	Affected versions	Patched versions
org.apache.myfaces.core:myfaces-impl Maven	`≥ 2.0.0, < 2.0.12≥ 2.1.0, < 2.1.6`	`2.0.122.1.6`
myfaces apache	`≥ 2.0.1, ≤ 2.0.11≥ 2.1.0, ≤ 2.1.5`	No fix yet

Description

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.

NVD description

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.

References

nvd.nist.gov/vuln/detail/CVE-2011-4367 · ADVISORY
exchange.xforce.ibmcloud.com/vulnerabilities/73100 · WEB
web.archive.org/web/20120213042504/http://www.securityfocus.com/bid/51939 · WEB
mail-archives.apache.org/mod_mbox/myfaces-announce/201202.mbox/%3C4F33ED1F.4070007%40apache.org%3E · WEB
seclists.org/fulldisclosure/2012/Feb/150 · WEB
osvdb.org/show/osvdb/79002 · Broken Link
secunia.com/advisories/47973 · Third Party Advisory
securityfocus.com/bid/51939 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free