CVE-2011-4367: Path Traversal
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATHINFO to faces/javax.faces.resource/.
Other sources
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATHINFO to faces/javax.faces.resource/.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4367?
CVE-2011-4367 is considered a high severity vulnerability due to its potential for directory traversal allowing unauthorized file access.
How do I fix CVE-2011-4367?
To fix CVE-2011-4367, upgrade to Apache MyFaces Core version 2.0.12 or 2.1.6 or later.
What software is affected by CVE-2011-4367?
CVE-2011-4367 affects Apache MyFaces Core versions 2.0.x before 2.0.12 and 2.1.x before 2.1.6.
Can CVE-2011-4367 allow remote code execution?
While CVE-2011-4367 primarily allows unauthorized file access, it may lead to further vulnerabilities and potential remote code execution in certain conditions.
How can I detect CVE-2011-4367 in my application?
To detect CVE-2011-4367, review your application's MyFaces version and check for any instances of directory traversal patterns in your web applications.