CVE-2020-6950
Medium
Description
Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Eclipse Mojarra
PublishedJun 2, 2021
First seenJun 2, 2021
How to fix
Update
- eclipse mojarra2.3.14 or later
- oracle hyperion_calculation_manager11.2.8.0 or later
- org.glassfish:mojarra-parent2.3.14 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse mojarra | v < 2.3.14 | 2.3.14 |
| oracle banking_enterprise_default_management | 2.10.0, 2.12.0 | — |
| oracle banking_platform | 2.6.2, 2.7.1, 2.9.0, 2.12.0 | — |
| oracle communications_network_integrity | 7.3.6 | — |
| oracle communications_pricing_design_center | 12.0.0.3.0 | — |
| oracle hyperion_calculation_manager | v < 11.2.8.0 | 11.2.8.0 |
| oracle retail_merchandising_system | 19.0.1 | — |
| oracle solaris_cluster | 4.0 | — |
| oracle time_and_labor | 12.2.6 ≤ v ≤ 12.2.11 | — |
| org.glassfish:mojarra-parentMaven | v < 2.3.14 | 2.3.14 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.