In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as WEB-INF/web.xml or /etc/passwd.
A flaw was found in Eclipse Mojarra before version 2.3.14, where it is vulnerable to a path traversal flaw via the loc parameter or the con parameter. An attacker could exploit this flaw to read arbitrary files.
Eclipse Mojarra before version 2.3.5 is vulnerable to a path traversal falw in the ResourceManager.java:getLocalePrefix() function via the loc parameter. An attacker could exploit this to read arbitrary files.
Upstream Patch:
https://github.com/eclipse-ee4j/mojarra/commit/1b434748d9239f42eae8aa7d37d7a0930c061e24
Eclipse Mojarra before version 2.3.5 is vulnerable to a path traversal falw in the ResourceManager.java:getLocalePrefix() function via the loc parameter. An attacker could exploit this to read arbitrary files.
Upstream Patch:
https://github.com/eclipse-ee4j/mojarra/commit/1b434748d9239f42eae8aa7d37d7a0930c061e24