Local Context Information Exposure in Mojarra Package - CVE-2012-2672
Summary
CVE-2012-2672: Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.ge... Affects mojarra versions < 2.2.8-1. Fixed in 2.2.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mojarra is the reference implementation of the JavaServer Faces (JSF) specification, which simplifies the development of user interfaces for Java web applications. It provides a set of reusable UI components and manages the state of these components across multiple requests. The vulnerability in question arises from improper handling of the FacesContext reference during the startup process, potentially exposing sensitive context information to local users.
Vulnerability Detail
CVE-2012-2672 is a vulnerability in Oracle Mojarra 2.1.7 that allows local users to access context information and resources from another WAR file by invoking the FacesContext.getCurrentInstance function. This issue stems from the failure to properly clean up the FacesContext reference during the startup phase, which can lead to unauthorized access to sensitive data. The ramifications of this vulnerability could include data leakage and unauthorized access to application resources, posing a significant security risk.
How To Fix
Minimum fixed version
2.2.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mojarraTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider isolating the application by restricting access to the WAR files and ensuring that sensitive resources are not exposed to local users. Implementing strict access controls and monitoring can help mitigate the risk until the package is updated.
Conclusion
CVE-2012-2672 presents a significant security risk for applications using the Mojarra package version 2.1.7. It is crucial to upgrade to a fixed version to protect against unauthorized access to sensitive context information. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for mojarra →
FAQ
CVE-2012-2672 is a vulnerability in the Mojarra package that allows local users to access sensitive context information from another WAR file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability could lead to unauthorized access to sensitive data and resources, resulting in data leakage and security breaches.
Mojarra version 2.1.7 is specifically affected by this vulnerability. Upgrading to version 2.2.8-1 or later is recommended.
Yes, you can mitigate the risk by restricting access to WAR files and implementing strict access controls until an upgrade is performed.
Related vulnerabilities
Recent vulnerabilities recorded for mojarra.
