Apache MyFaces Vulnerable to Path Traversal

中 5.0CVE-2011-4367 · GHSA-gjfx-9wx3-j6r7 · 19/06/2014 公開 · 16/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.myfaces.core:myfaces-impl Maven	`≥ 2.0.0, < 2.0.12≥ 2.1.0, < 2.1.6`	`2.0.122.1.6`
myfaces apache	`≥ 2.0.1, ≤ 2.0.11≥ 2.1.0, ≤ 2.1.5`	修正版なし

概要

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.

NVD の説明

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.

参考情報

nvd.nist.gov/vuln/detail/CVE-2011-4367 · ADVISORY
exchange.xforce.ibmcloud.com/vulnerabilities/73100 · WEB
web.archive.org/web/20120213042504/http://www.securityfocus.com/bid/51939 · WEB
mail-archives.apache.org/mod_mbox/myfaces-announce/201202.mbox/%3C4F33ED1F.4070007%40apache.org%3E · WEB
seclists.org/fulldisclosure/2012/Feb/150 · WEB
osvdb.org/show/osvdb/79002 · Broken Link
secunia.com/advisories/47973 · Third Party Advisory
securityfocus.com/bid/51939 · Exploit

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン