Vulnerability · Published Jun 2, 2021 · Assigned by mitre
CVE-2020-6950
Medium 6.5
In plain English
A medium-severity security flaw in the org.glassfish:mojarra-parent package (Maven). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 10.1% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)10.1%top 4.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Nuclei, Public PoC
Official description
Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.glassfish:mojarra-parent | 2.3.14 | GHSA-rpq8-mmwh-q9hm |
Affected products (as reported)
References
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
- https://github.com/eclipse-ee4j/mojarra/issues/4571 x_refsource_MISC
- https://github.com/eclipse-ee4j/mojarra/commit/cefbb9447e7be560e59da2da6bd7cb93776f7741 x_refsource_MISC
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=550943 x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC