The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NEclipse Mojarra
APPEclipse< 2.3.7
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path Traversal
CWE
Related vulnerabilities
CVE-2026-46581HIGH7.5PL ✓same product
Eclipse Mojarra: path traversal do zdalnych Faceletów w DefaultFaceletFactory
CVE-2020-6950MEDIUM6.5same product
Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc para...
CVE-2019-17091MEDIUM6.1same product
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.1...
CVE-2026-12605CRITICAL9.6PL ✓same vendor
Eclipse GlassFish: CSRF+SSRF w DownloadServlet umożliwia przejęcie domeny
CVE-2026-60007CRITICAL9.1PL ✓same vendor
Eclipse Milo: padding oracle w uwierzytelnianiu OPC-UA umożliwia odzyskanie hasła