PT-2014-2169 · Apache · Apache Myfaces Core

Paul Nicolucci · Published 2014-06-19 · Updated 2022-05-13 · CVE-2011-4367

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache MyFaces Core versions 2.0.x through 2.0.11 Apache MyFaces Core versions 2.1.x through 2.1.5

Description Multiple directory traversal issues in Apache MyFaces Core allow remote attackers to read arbitrary files. This is achieved by including a .. (dot dot) in the ln parameter to the faces/javax.faces.resource/web.xml endpoint or in the PATH INFO to the faces/javax.faces.resource/ endpoint.

Recommendations For Apache MyFaces Core versions 2.0.x through 2.0.11, update to version 2.0.12 or later. For Apache MyFaces Core versions 2.1.x through 2.1.5, update to version 2.1.6 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2011-4367

GHSA-GJFX-9WX3-J6R7

Affected Products

Apache Myfaces Core

References · 10

• 🔥 http://seclists.org/fulldisclosure/2012/Feb/150 · Exploit
• 🔥 http://mail-archives.apache.org/mod_mbox/myfaces-announce/201202.mbox/%3C4F33ED1F.4070007%40apache.org%3E · Exploit
• 🔥 http://securityfocus.com/bid/51939 · Exploit
• 🔥 https://exploit-db.com/exploits/36681 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4367 · Security Note
• https://osv.dev/vulnerability/GHSA-gjfx-9wx3-j6r7 · Vendor Advisory
• https://web.archive.org/web/20120213042504/http://securityfocus.com/bid/51939 · Note
• http://osvdb.org/show/osvdb/79002 · Note
• http://secunia.com/advisories/47973 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73100 · Note