Eclipse Mojarra vulnerabilities
4 known vulnerabilities affecting eclipse/mojarra.
Total CVEs
4
CISA KEV
0
Public exploits
1
Exploited in wild
0
Severity breakdown
HIGH2MEDIUM2
Vulnerabilities
Page 1 of 1
CVE-2020-6950P3MEDIUMCVSS 6.5PoCfixed in 2.3.142021-06-02
CVE-2020-6950 [MEDIUM] CWE-22 CVE-2020-6950: Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via th
Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
nvd
CVE-2026-46581P3HIGHCVSS 7.5≥ 2.3.0, ≤ 4.1.13v5.0.0-milestone1+4 more2026-08-05
CVE-2026-46581 [HIGH] CWE-22 CVE-2026-46581: In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not prope
In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files suc
nvd
CVE-2018-14371P3HIGHCVSS 7.5fixed in 2.3.72018-07-18
CVE-2018-14371 [HIGH] CWE-22 CVE-2018-14371: The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by
The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.
nvd
CVE-2019-17091P4MEDIUMCVSS 6.1≥ 2.3.0, < 2.3.102019-10-02
CVE-2019-17091 [MEDIUM] CWE-79 CVE-2019-17091: faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J be
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
nvd