Unscored severity · published Jun 19, 2014
CVE-2011-4367
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read…
–
CVSS
33.7%
EPSS
No
On KEV
Description
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.
Exploitation
Is it being used?
Exploit prediction (EPSS)33.7% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MY
Myfaces · Apache
2.0.1 through 2.0.11; 2.1.0 through 2.1.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4367
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4367
Exploit
http://mail-archives.apache.org/mod_mbox/myfaces-announce/201202.mbox/%3C4F33ED1F.4070007%40apache.org%3E
Broken Link
http://osvdb.org/show/osvdb/79002
Exploit
http://seclists.org/fulldisclosure/2012/Feb/150
Third Party Advisory
http://secunia.com/advisories/47973
Exploit
http://www.securityfocus.com/bid/51939
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/73100
More from Myfaces
7.5
CVE-2021-26296
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and…
7.5
CVE-2011-4343
Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters
–
CVE-2010-2057
shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code…
–
CVE-2010-2086
Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote…