The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.
References:GSA_kwCzR0hTQS00M3E3LXE1dnAtM2c2OM4AAWSt
Path Traversal in Eclipse Mojarra
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| maven:org.glassfish:mojarra-parent | < 2.3.7 | 2.3.7 | |
Affected Version RangesAll affected versionsAll unaffected versions2.3.15, 2.3.16, 2.3.17, 2.3.18, 2.3.19, 2.3.20, 2.3.21, 3.0.0, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8, 4.0.9, 4.0.10, 4.0.11, 4.1.0, 4.1.1, 4.1.2, 4.1.3 |
|||