PT-2018-3873 · Eclipse · Eclipse Mojarra

Publicado 2018-07-18 · Atualizado 2022-05-14 · CVE-2018-14371

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Mojarra versions prior to 2.3.7

Description The issue concerns the getLocalePrefix function in ResourceManager.java, which is affected by a directory traversal vulnerability via the loc parameter. This allows a remote attacker to download configuration files or Java bytecodes from applications. The vulnerability is related to incorrect restriction of a directory path name with limited access, enabling an attacker to gain unauthorized access to protected information.

Recommendations For Eclipse Mojarra versions prior to 2.3.7, update to version 2.3.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the getLocalePrefix function in ResourceManager.java to minimize the risk of exploitation. Avoid using the loc parameter in vulnerable API endpoints until the issue is resolved.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2023-02664

CVE-2018-14371

GHSA-43Q7-Q5VP-3G68

RHSA-2020:2063

RHSA-2020:2511

RHSA-2020:2512

RHSA-2020:2513

Produtos afetados

Eclipse Mojarra

Referências · 13

• https://github.com/eclipse-ee4j/mojarra/commit/1b434748d9239f42eae8aa7d37d7a0930c061e24 · Correção
• https://github.com/eclipse-ee4j/mojarra/pull/4384 · Nota
• https://github.com/javaserverfaces/mojarra/issues/4364 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-14371 · Nota de Segurança
• https://github.com/advisories/GHSA-43q7-q5vp-3g68 · Nota
• https://ubuntu.com/security/CVE-2018-14371 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-14371 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-43q7-q5vp-3g68 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-14371 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2018-14371 · Nota
• https://oracle.com/security-alerts/cpuapr2023.html?3289 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14371 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-02664 · Nota de Segurança