CVE-2011-4367 EXPLOIT
5.0
MEDIUM · CVSS 2.0 · EPSS 33.7% (pctl 98)
Patch early
A public exploit exists.
Description
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.
Scoring
| CVSS | 5.0 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| EPSS | 33.75% — more likely to be exploited than 98% of all CVEs |
| Weakness | CWE-22 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2014-06-19 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| apache | myfaces |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Apache MyFaces - 'ln' Information Disclosure | 2012-02-09 |
References
- http://mail-archives.apache.org/mod_mbox/myfaces-announce/201202.mbox/%3C4F33ED1F.4070007%40apache.org%3E
- http://osvdb.org/show/osvdb/79002
- http://seclists.org/fulldisclosure/2012/Feb/150
- http://secunia.com/advisories/47973
- http://www.securityfocus.com/bid/51939
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73100
- http://mail-archives.apache.org/mod_mbox/myfaces-announce/201202.mbox/%3C4F33ED1F.4070007%40apache.org%3E
- http://osvdb.org/show/osvdb/79002
- http://seclists.org/fulldisclosure/2012/Feb/150
- http://secunia.com/advisories/47973
- http://www.securityfocus.com/bid/51939
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73100
→ the Explorer · watch your stack · NVD