CVE-2018-14371: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

May 14, 2022 (updated July 24, 2023)

The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.

References

github.com/advisories/GHSA-43q7-q5vp-3g68
github.com/eclipse-ee4j/mojarra/commit/1b434748d9239f42eae8aa7d37d7a0930c061e24
github.com/eclipse-ee4j/mojarra/pull/4384
nvd.nist.gov/vuln/detail/CVE-2018-14371

Code Behaviors & Features

Detect and mitigate CVE-2018-14371 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →