Published: 17/06/2012 Updated: 29/08/2017

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N

Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function.

Vulnerable Product	Search on Vulmon	Subscribe to Product
oracle mojarra 2.1.7

Debian Bug report logs - #740586 mojarra: CVE-2013-5855 Package: mojarra; Maintainer for mojarra is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Mon, 3 Mar 2014 08:15:01 UTC Severity: grave Tags: security Fixed in version mojarra/22 ...

Debian Bug report logs - #677194 CVE-2012-2672 Package: mojarra; Maintainer for mojarra is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <muehlenhoff@univentionde> Date: Tue, 12 Jun 2012 08:42:01 UTC Severity: important Tags: moreinfo, security Fixed in vers ...

Synopsis Important: JBoss Enterprise Application Platform 601 update Type/Severity Security Advisory: Important Topic JBoss Enterprise Application Platform 601, which fixes multiple securityissues, various bugs, and adds enhancements, is now available from the RedHat Customer PortalThe Red Hat Security ...

Synopsis Important: JBoss Enterprise Application Platform 601 update Type/Severity Security Advisory: Important Topic Updated JBoss Enterprise Application Platform 601 packages that fixmultiple security issues, various bugs, and add enhancements are nowavailable for Red Hat Enterprise Linux 5The Red Ha ...

Synopsis Important: JBoss Enterprise Application Platform 601 update Type/Severity Security Advisory: Important Topic Updated JBoss Enterprise Application Platform 601 packages that fixmultiple security issues, various bugs, and add enhancements are nowavailable for Red Hat Enterprise Linux 6The Red Ha ...

NVD-CWE-Other http://java.net/jira/browse/JAVASERVERFACES-2436 http://www.openwall.com/lists/oss-security/2012/06/07/3 http://www.openwall.com/lists/oss-security/2012/06/07/2 http://secunia.com/advisories/49284 https://issues.jboss.org/browse/JBPAPP-9197 http://rhn.redhat.com/errata/RHSA-2012-1592.html http://rhn.redhat.com/errata/RHSA-2012-1591.html http://secunia.com/advisories/51607 http://rhn.redhat.com/errata/RHSA-2012-1594.html https://exchange.xforce.ibmcloud.com/vulnerabilities/76179 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=740586 https://access.redhat.com/errata/RHSA-2012:1594

CVE-2012-2672

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect