Directory Traversal

2017-03-2804:33:28

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

JSON

JavaServer Faces is vulnerable to directory traversals. A malicious user can access arbitrary files through a Uniform Resource Identifier or a through the library name.

CPENameOperatorVersion
oracle's implementation of the jsf 2.2 specification.eq2.0.9
oracle's implementation of the jsf 2.2 specification.eq2.1.5
oracle's implementation of the jsf 2.2 specification.eq2.1.6
oracle's implementation of the jsf 2.2 specification.eq2.1.7
oracle's implementation of the jsf 2.2 specification.le2.1.18
oracle's implementation of the jsf 2.2 specification.le2.1.4
oracle's implementation of the jsf 2.2 specification.le2.2.0-m09
oracle's implementation of the jsf 2.2 specification.le2.0.8

Name	Operator	Version
oracle's implementation of the jsf 2.2 specification.	eq	2.0.9
oracle's implementation of the jsf 2.2 specification.	eq	2.1.5
oracle's implementation of the jsf 2.2 specification.	eq	2.1.6
oracle's implementation of the jsf 2.2 specification.	eq	2.1.7
oracle's implementation of the jsf 2.2 specification.	le	2.1.18
oracle's implementation of the jsf 2.2 specification.	le	2.1.4
oracle's implementation of the jsf 2.2 specification.	le	2.2.0-m09
oracle's implementation of the jsf 2.2 specification.	le	2.0.8