CVE-2020-6950

nvd nist nuclei

Published: Jun 2, 2021Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.

Affected (13)

Products: Eclipse: Mojarra · Oracle: Banking Enterprise Default Management, Banking Platform, Communications Network Integrity, Communications Pricing Design Center, Hyperion Calculation Manager, Retail Merchandising System, Solaris Cluster, Time And Labor

1 product

8 products

Banking Enterprise Default Management

Banking Platform

Communications Network Integrity

Communications Pricing Design Center

Hyperion Calculation Manager

Retail Merchandising System

Solaris Cluster

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Eclipse Mojarra	version < 2.3.14

Configuration B

12 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Enterprise Default Management	Version 2.10.0
Oracle Banking Enterprise Default Management	Version 2.12.0
Oracle Banking Platform	Version 2.12.0
Oracle Banking Platform	Version 2.6.2
Oracle Banking Platform	Version 2.7.1
Oracle Banking Platform	Version 2.9.0
Oracle Communications Network Integrity	Version 7.3.6
Oracle Communications Pricing Design Center	Version 12.0.0.3.0
Oracle Hyperion Calculation Manager	version < 11.2.8.0
Oracle Retail Merchandising System	Version 19.0.1
Oracle Solaris Cluster	Version 4.0
Oracle Time And Labor	12.2.6 ≤ version ≤ 12.2.11

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (12)

https://bugs.eclipse.org/bugs/show_bug.cgi?id=550943

Source: cve@mitre.org

Issue TrackingVendor Advisory

https://github.com/eclipse-ee4j/mojarra/commit/cefbb9447e7be560e59da2da6bd7cb93776f7741

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/eclipse-ee4j/mojarra/issues/4571

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: cve@mitre.org

PatchThird Party Advisory

https://bugs.eclipse.org/bugs/show_bug.cgi?id=550943

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://github.com/eclipse-ee4j/mojarra/commit/cefbb9447e7be560e59da2da6bd7cb93776f7741

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/eclipse-ee4j/mojarra/issues/4571

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.