Apache MyFaces Vulnerable to Path Traversal

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a `..` (dot dot) in the (1) ln parameter to `faces/javax.faces.resource/web.xml` or (2) the `PATH_INFO` to `faces/javax.faces.resource/`.

Vulnerability ID: GHSA-gjfx-9wx3-j6r7
Aliases: CVE-2011-4367
Published: 2022-05-13 01:24:34
CWE: CWE-22
Severity rating: MODERATE
Affected packages:
package: ecosystem: Maven
name: org.apache.myfaces.core:myfaces-impl
package: ecosystem: Maven
name: org.apache.myfaces.core:myfaces-impl