Eclipse Mojarra
Monthly
Remote file inclusion and path traversal in Eclipse Mojarra 2.3 through 5.0 allows unauthenticated network attackers to force server-side Facelet resolution of attacker-controlled URLs via the `DefaultFaceletFactory` component, exposing restricted files with the privileges of the application server. The attack targets the JSF template resolution pipeline and can leak sensitive configuration data from `WEB-INF/web.xml` (which typically contains database credentials and security settings) or OS-level files such as `/etc/passwd`. SSVC rates the attack as automatable with no confirmed active exploitation at time of analysis, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector means no barriers exist between a remote attacker and a vulnerable endpoint.
Remote file inclusion and path traversal in Eclipse Mojarra 2.3 through 5.0 allows unauthenticated network attackers to force server-side Facelet resolution of attacker-controlled URLs via the `DefaultFaceletFactory` component, exposing restricted files with the privileges of the application server. The attack targets the JSF template resolution pipeline and can leak sensitive configuration data from `WEB-INF/web.xml` (which typically contains database credentials and security settings) or OS-level files such as `/etc/passwd`. SSVC rates the attack as automatable with no confirmed active exploitation at time of analysis, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector means no barriers exist between a remote attacker and a vulnerable endpoint.