← back
CVE-2011-4367

CVE-2011-4367

EPSS 33.5%
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.
Affected products
n/a · n/a
public PoCs found — 2
githubgithub.com/shoucheng3/apache__myfaces_CVE-2011-4367_2-0-11★ 0exploitdbwww.exploit-db.com/exploits/36681unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://mail-archives.apache.org/mod_mbox/myfaces-announce/201202.mbox/%3C4F33ED1F.4070007%40apache.org%3Ehttp://osvdb.org/show/osvdb/79002http://seclists.org/fulldisclosure/2012/Feb/150http://secunia.com/advisories/47973https://exchange.xforce.ibmcloud.com/vulnerabilities/73100http://www.securityfocus.com/bid/51939