CVE-2012-2672

Published: Jun 17, 2012Modified: Apr 29, 2026

2.1

Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function.

Affected (1)

Products: Oracle: Mojarra

Oracle

1 product

Mojarra

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Mojarra	Version 2.1.7

References (20)

http://java.net/jira/browse/JAVASERVERFACES-2436

Source: secalert@redhat.com

Exploit

http://rhn.redhat.com/errata/RHSA-2012-1591.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1592.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1594.html

Source: secalert@redhat.com

http://secunia.com/advisories/49284

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/51607

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/06/07/2

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/06/07/3

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/76179

Source: secalert@redhat.com

https://issues.jboss.org/browse/JBPAPP-9197

Source: secalert@redhat.com

http://java.net/jira/browse/JAVASERVERFACES-2436