Description
The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.
Remediation
References
https://github.com/eclipse-ee4j/mojarra/commit/1b434748d9239f42eae8aa7d37d7a0930c061e24
https://github.com/javaserverfaces/mojarra/issues/4364
Related Vulnerabilities
CVE-2021-22096 Vulnerability in maven package org.springframework:spring-webflux
CVE-2019-12406 Vulnerability in maven package org.apache.cxf:cxf-core
CVE-2023-33246 Vulnerability in maven package org.apache.rocketmq:rocketmq-controller
CVE-2021-43138 Vulnerability in maven package org.webjars.npm:async
CVE-2022-45868 Vulnerability in maven package com.h2database:h2