Which products and versions are affected by CVE-2011-4367?

Affected: Myfaces (Apache); mojarra (debian); org.apache.myfaces.core:myfaces-impl (maven) versions >= 2.0.0. The full list is in the CVE brief.

Is CVE-2011-4367 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2011-4367 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2011-4367?

Public exploit code is available.

How urgently should CVE-2011-4367 be patched?

Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Request A Demo

WatchlistHigh

CVE-2011-4367Myfaces Path Traversal

Apache MyFaces Vulnerable to Path Traversal

Published May 13, 2022 · Updated Nov 29, 2024 · Also known as GHSA-gjfx-9wx3-j6r7

Key Facts

Patch immediately

CVE-2011-4367 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Myfaces (Apache), mojarra (debian), org.apache.myfaces.core:myfaces-impl (maven).
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 34% probability of exploitation in the next 30 days.
Fixed versions are available, including Myfaces 2.0.11, org.apache.myfaces.core:myfaces-impl 2.0.12, org.apache.myfaces.core:myfaces-impl 2.1.6.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Scores

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (30-day exploit likelihood)

34%

Higher than 98.3% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

40/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Advisories And Exploit References

advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2011-4367
advisory47973
advisoryGHSA advisory

Description

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.

Affected Products

7 affected entries in total

Product	Affected versions	Fixed in
MyfacesApache	See advisory	2.0.11
mojarradebian	See advisory	0
org.apache.myfaces.core:myfaces-implmaven	>= 2.0.0	2.1.6

Patched Releases

Myfaces

2.0.11

org.apache.myfaces.core:myfaces-impl

2.0.12, 2.1.6

Timeline

Publicly disclosed
May 13, 2022
Last updated
Nov 29, 2024

Weakness Type

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

5 more references in the full CVE brief

FAQ

Common Questions.

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a ..
Affected: Myfaces (Apache); mojarra (debian); org.apache.myfaces.core:myfaces-impl (maven) versions >= 2.0.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Myfaces 2.0.11, org.apache.myfaces.core:myfaces-impl 2.0.12, org.apache.myfaces.core:myfaces-impl 2.1.6.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Is CVE-2011-4367 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.