CVE-2013-3827

Path Traversal in Eclipse Mojarra

5.0 MediumPublic exploitFix available

Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container.

Exploit likelihood

32.4%Up 20.7 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2013-3827
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-3827
Updated: 2026-11-02

EUVDEUVD-2022-4865 No score

Record: EUVD-2022-4865
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q388-j7cw-ff7w No score

Path Traversal in Eclipse Mojarra

Multiple path traversal flaws where found in Mojarra JSF2 implementation for identifying resources by name or from libraries. An unauthenticated remote attacker can use these flaws to gather otherwise undisclosed information from within an application's root.

Record: GHSA-q388-j7cw-ff7w
Weakness: CWE-22
Updated: 2026-11-02

OSVGHSA-q388-j7cw-ff7w No score

Path Traversal in Eclipse Mojarra

Record: GHSA-q388-j7cw-ff7w
Weakness: CWE-22
Updated: 2026-11-02

Affected products

oracle fusion middleware

Affected packages

Affected packages
Package	Affected	Fixed
`org.glassfish:javax.faces` Maven	2.0.0 up to 2.1.19	2.1.19
`org.glassfish:javax.faces` Maven	2.0.0 up to 2.1.19, plus listed versions 2.0.102.0.112.0.11-012.0.11-022.0.11-03 Show 35 moreShow less 2.0.72.0.82.0.92.0.9-022.0.9-052.0.9-082.1.102.1.112.1.122.1.132.1.142.1.152.1.162.1.172.1.182.1.22.1.32.1.42.1.52.1.5-022.1.5-042.1.62.1.72.1.7-012.1.7-022.1.7-032.1.7-042.1.7-052.1.7-062.1.7-072.1.7-082.1.7-092.1.7-102.1.82.1.9	2.1.19

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Oracle GlassFish Server 2.1.1/3.0.1 - Multiple Subcomponent Resource Identifier Traversal Arbitrary File Access	2013-10-15
Nuclei	Javafaces LFI
PoC in GitHub	thistehneisen/CVE-2013-3827	2023-08-05

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-3827 is a medium vulnerability (CVSS 5.0) in Oracle Fusion Middleware, published October 16, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 32.4%, the 98th percentile. Fixed in org.glassfish:javax.faces 2.1.19.