CVE-2020-6950: Directory Traversal in Eclipse Mojarra
Summary
CVE-2020-6950: Directory traversal in Eclipse Mojarra. Affects org.glassfish:mojarra-parent versions < 2.3.14. Fixed in 2.3.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Mojarra is an open-source implementation of the JavaServer Faces (JSF) specification. It provides a runtime environment for building web applications using JSF. The Mojarra library is widely used in Java web development projects. However, versions prior to 2.3.14 are vulnerable to a directory traversal attack.
Vulnerability Detail
The vulnerability, identified as CVE-2020-6950, allows attackers to read arbitrary files by exploiting the 'loc' or 'con' parameter in Eclipse Mojarra. By manipulating these parameters, an attacker can traverse directories and access sensitive files on the server. This can lead to unauthorized disclosure of confidential information and potential compromise of the application or system.
How To Fix
Minimum fixed version
2.3.14
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented. This involves validating and sanitizing the 'loc' and 'con' parameters to prevent directory traversal attacks. Developers should ensure that the requested file paths are within the intended directory structure and do not allow access to sensitive files outside of the application's scope. Implementing input validation and filtering can help mitigate the risk until the library is updated.
Conclusion
The directory traversal vulnerability in Eclipse Mojarra can have serious consequences, including unauthorized access to sensitive files and potential compromise of the application or system. It is crucial to upgrade to the patched version or implement the recommended workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.glassfish:mojarra-parent →
FAQ
Eclipse Mojarra is an open-source implementation of the JavaServer Faces (JSF) specification, providing a runtime environment for building web applications using JSF.
Directory traversal is a technique used by attackers to access files and directories outside of the intended scope. It involves manipulating file paths to navigate to parent directories or other locations on the server.
The vulnerability allows attackers to read arbitrary files on the server, potentially leading to unauthorized disclosure of sensitive information. It can also be leveraged to gain deeper access to the system and compromise the application or server.
To fix this vulnerability, upgrade Eclipse Mojarra to version 2.3.14 or later. Alternatively, implement input validation and filtering to prevent directory traversal attacks until the library can be updated.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.glassfish:mojarra-parent.
