CVE-2011-4367
Apache MyFaces Vulnerable to Path Traversal
CVE-2011-4367 is a medium vulnerability (CVSS 5.0) in Apache Myfaces, published June 19, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 33.7%, the 98th percentile. Fixed in org.apache.myfaces.core:myfaces-impl 2.0.12.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 33.7%EPSS, 98th percentile
- Exploitation
- None known2 public exploits
- Fixed in
2.0.12org.apache.myfaces.core:myfaces-impl +3 more
Description
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.myfaces.core:myfaces-implMaven | 2.0.0 up to 2.0.12 | 2.0.12 |
org.apache.myfaces.core:myfaces-implMaven | 2.1.0 up to 2.1.6 | 2.1.6 |
org.apache.myfaces.core:myfaces-implMaven | 2.0.0 up to 2.0.12, plus listed versions 2.0.12.0.102.0.112.0.22.0.3 Show 6 moreShow less2.0.42.0.52.0.62.0.72.0.82.0.9 | 2.0.12 |
org.apache.myfaces.core:myfaces-implMaven | 2.1.0 up to 2.1.6, plus listed versions 2.1.12.1.22.1.32.1.42.1.5 | 2.1.6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache MyFaces - 'ln' Information Disclosure | 2012-02-09 |
| PoC in GitHub | shoucheng3/apache__myfaces_CVE-2011-4367_2-0-11 | 2025-08-16 |
What each source reports
NVD Score used
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.
- Record
CVE-2011-4367- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE ListNo score
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.
- Record
CVE-2011-4367- Updated
- 2026-11-02
EUVDEUVD-2022-3967No score
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.
- Record
EUVD-2022-3967- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gjfx-9wx3-j6r7No score
Apache MyFaces Vulnerable to Path Traversal
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.
- Record
GHSA-gjfx-9wx3-j6r7- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-gjfx-9wx3-j6r7No score
Apache MyFaces Vulnerable to Path Traversal
Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.
- Record
GHSA-gjfx-9wx3-j6r7- Weakness
- CWE-22
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
seclists.org/fulldisclosure/2012/Feb/150
osvdb.org/show/osvdb/79002
exchange.xforce.ibmcloud.com/vulnerabilities/73100
secunia.com/advisories/47973
securityfocus.com/bid/51939
mail-archives.apache.org/mod_mbox/myfaces-announce/201202.mbox/%3C4F33ED1F.4070007%40apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2011-4367
web.archive.org/web/20120213042504/http://www.securityfocus.com/bid/51939
github.com/advisories/GHSA-gjfx-9wx3-j6r7