Skip to content
OpenAdvisories
Medium Scanner template Public exploit CVE-2013-3827 EUVD-2022-4865GHSA-q388-j7cw-ff7w

Path Traversal in Eclipse Mojarra

Published Oct 16, 2013 · Updated Aug 6, 2024 · Assigned by oracle

Package: org.glassfish:javax.faces Ecosystem: Maven

Description

Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • thistehneisen/CVE-2013-3827 ★ 1 · Aug 5, 2023

    Quick PoC checker for common configurations that might be available via directory traversal due to CVE-2013-3827

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.glassfish:javax.faces >= 2.0.0, < 2.1.19 2.1.19 GHSA-q388-j7cw-ff7w

References