Description

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

Severity (CVSS)

Base score7.5
SeverityHigh
VersionCVSS 3.1
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Provided byCISA-ADP

Weaknesses

  • CWE-22 — CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-94 — CWE-94: Improper Control of Generation of Code ('Code Injection')
  • CWE-641 — CWE-641: Improper Restriction of Names for Files and Other Resources

Affected products

VendorProductVersions
Eclipse FoundationEclipse Mojarra2.3 to <=5.0

References

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 06 Aug 2026 07:06 UTC.