CVE-2011-4367 Apache MyFaces Vulnerable to Path Traversal

What is CVE-2011-4367?

CVE-2011-4367 is a medium-severity path traversal vulnerability in n/a, published on 19 Jun 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.

Weakness: CWE-22

Which versions are affected by CVE-2011-4367?

4 open source packages ship an affected version, including org.apache.myfaces.core:myfaces-impl. It affects 1 product.

Products include Apache Myfaces.

How do I fix CVE-2011-4367?

Upgrade org.apache.myfaces.core:myfaces-impl to a fixed version for your release line: 2.0.12 or 2.1.6.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2011-4367 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-4367 exists.

Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2021-26296 Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces High 7.5
• CVE-2011-4343 Apache MyFaces Vulnerable to EL Injection High 7.5
• CVE-2010-2057 Improper Authentication in Apache MyFaces Medium 5.0
• CVE-2010-2086 Apache MyFaces Cross-site Scripting vulnerability Medium 4.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gjfx-9wx3-j6r7.