Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2011-4367

CWE-22 — Path TraversalCWE-200 — Information Exposure8 documents8 sources
Severity
5.0MEDIUM
EPSS
85.9%
top 0.61%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Apache Myfaces
Timeline
PublishedJun 19
Latest updateMay 13

Description

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶Mavenorg.apache.myfaces.core:myfaces-impl2.0.0 — 2.0.12+1
▶NVDapache/myfaces2.0.1 — 2.0.11+1

🔴Vulnerability Details

3
OSV
Apache MyFaces Vulnerable to Path Traversal↗2022-05-13
▶
GHSA
Apache MyFaces Vulnerable to Path Traversal↗2022-05-13
▶
CVEList
CVE-2011-4367: Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2↗2014-06-19
▶

💥Exploits & PoCs

1
Exploit-DB
Apache MyFaces - 'ln' Information Disclosure↗2012-02-09
▶

📋Vendor Advisories

2
Red Hat
MyFaces: multiple directory traversal vulnerabilities allow remote attackers to read arbitrary files↗2020-08-05
▶
Debian
CVE-2011-4367: mojarra - Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) i...↗2011
▶

💬Community

1
Bugzilla
CVE-2011-4367 MyFaces: multiple directory traversal vulnerabilities allow remote attackers to read arbitrary files↗2020-08-05
▶
CVE-2011-4367 (MEDIUM CVSS 5) | Multiple directory traversal vulner | cvebase.io