PT-2020-1329 · Oracle+1 · Oracle Weblogic Server+1

Published 2020-01-14 · Updated 2025-11-12 · CVE-2020-6950

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Mojarra versions prior to 2.3.14 Oracle WebLogic Server (affected versions not specified)

Description The issue allows attackers to read arbitrary files or affect the system via the HTTP protocol. It is related to a lack of protection for service data in the Web Container component of Oracle WebLogic Server, which uses JavaServer Faces. The loc parameter or con parameter can be used to exploit this issue.

Recommendations For Eclipse Mojarra versions prior to 2.3.14, update to version 2.3.14 or later. For Oracle WebLogic Server, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Path traversal

Weakness Enumeration

CWE-200

CWE-22

Related Identifiers

BDU:2020-00232

CVE-2020-6950

GHSA-RPQ8-MMWH-Q9HM

OESA-2021-1229

RHSA-2020:2511

RHSA-2020:2512

RHSA-2020:2513

RHSA-2020:3637

RHSA-2020:3638

RHSA-2020:3639

Affected Products

Eclipse Mojarra

Oracle Weblogic Server

References · 24

• https://github.com/eclipse-ee4j/mojarra/commit/cefbb9447e7be560e59da2da6bd7cb93776f7741 · Patch
• https://osv.dev/vulnerability/GHSA-rpq8-mmwh-q9hm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-6950 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2022.html · Patch
• https://osv.dev/vulnerability/OESA-2021-1229 · Vendor Advisory
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=550943 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00232 · Security Note
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-6950 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6950 · Security Note
• https://github.com/eclipse-ee4j/mojarra/issues/4571 · Note
• https://github.com/eclipse-ee4j/mojarra · Note
• https://t.me/cvenotify/43185 · Telegram Post
• https://t.me/cvenotify/43862 · Telegram Post