PT-2014-2169 · Apache · Apache Myfaces Core

Paul Nicolucci · Publicado 2014-06-19 · Atualizado 2022-05-13 · CVE-2011-4367

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache MyFaces Core versions 2.0.x through 2.0.11 Apache MyFaces Core versions 2.1.x through 2.1.5

Description Multiple directory traversal issues in Apache MyFaces Core allow remote attackers to read arbitrary files. This is achieved by including a .. (dot dot) in the ln parameter to the faces/javax.faces.resource/web.xml endpoint or in the PATH INFO to the faces/javax.faces.resource/ endpoint.

Recommendations For Apache MyFaces Core versions 2.0.x through 2.0.11, update to version 2.0.12 or later. For Apache MyFaces Core versions 2.1.x through 2.1.5, update to version 2.1.6 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2011-4367

GHSA-GJFX-9WX3-J6R7

Produtos afetados

Apache Myfaces Core

Referências · 10

• 🔥 http://seclists.org/fulldisclosure/2012/Feb/150 · Exploit
• 🔥 http://mail-archives.apache.org/mod_mbox/myfaces-announce/201202.mbox/%3C4F33ED1F.4070007%40apache.org%3E · Exploit
• 🔥 http://securityfocus.com/bid/51939 · Exploit
• 🔥 https://exploit-db.com/exploits/36681 · Exploit
• https://web.archive.org/web/20120213042504/http://securityfocus.com/bid/51939 · Nota
• http://osvdb.org/show/osvdb/79002 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4367 · Nota de Segurança
• http://secunia.com/advisories/47973 · Nota
• https://osv.dev/vulnerability/GHSA-gjfx-9wx3-j6r7 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73100 · Nota