Skip to content
Fencer Intel
medium 5.0

CVE-2011-4367 json

Apache MyFaces Vulnerable to Path Traversal

published 2014-06-19 12 y ago modified 2026-06-16 4 mo ago also GHSA-gjfx-9wx3-j6r7 , EUVD-2022-3967

cvss
5.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
33.7%
EPSS 33.7% chance of exploitation in 30 days, percentile 98%
public exploits
1
Exploit-DB

Summary

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.

Patch / fix

  • maven org.apache.myfaces.core:myfaces-impl 2.0.12, 2.1.6

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2011-4367 updated cvss 7.5

MyFaces: multiple directory traversal vulnerabilities allow remote attackers to read arbitrary files

  • Red Hat BPM Suite 6 MyFaces MyFaces Red Hat Decision Manager 7 MyFaces MyFaces Red Hat JBoss Enterprise Application Platform 6 MyFaces MyFaces Red Hat JBoss Enterprise Application Platform 7 MyFaces MyFaces Red Hat JBoss Enterprise Application Platform Continuous Delivery MyFaces MyFaces Red Hat JBoss Fuse 6 MyFaces MyFaces
    +1 more products
    Red Hat Process Automation 7 MyFaces MyFaces
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-36681)
  2. Published

Exploit prediction

33.75% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-36681 Apache MyFaces - 'ln' Information Disclosure remote, 2012-02-09
  • seclists.org http://seclists.org/fulldisclosure/2012/Feb/150 referenced PoC, tagged "exploit" by a source, unverified
  • securityfocus.com http://www.securityfocus.com/bid/51939 referenced PoC, tagged "exploit" by a source, unverified
  • mail-archives.apache.org http://mail-archives.apache.org/mod_mbox/myfaces-announce/201202.mbox/%3C4F33ED1F.4070007%40apache.org%3E referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.myfaces.core:myfaces-impl
>=2.0.0, <2.0.12
>=2.1.0, <2.1.6
2.0.12
2.1.6

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.