Mojarra CVEs
8 CVEs, 5 protected by Waratek
Overview 8 matches · 5 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
5
62.5%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
3
37.5%
blocked by ARMR today
5
62.5%
partly blocked
0
0.0%
not blocked
3
37.5%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
1
12.5%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
7
87.5%
split by
peak 2 / year
20102
No exploit published2
Medium2
not blocked2
No public exploit2
20110
20121
No exploit published1
Low1
not blocked1
No public exploit1
20130
20141
Protected by Waratek1
Medium1
blocked by ARMR today1
No public exploit1
20150
20160
20170
20181
Protected by Waratek1
High1
blocked by ARMR today1
No public exploit1
20191
Protected by Waratek1
Medium1
blocked by ARMR today1
No public exploit1
20200
20211
Protected by Waratek1
Medium1
blocked by ARMR today1
Working exploit published1
20220
20230
20240
20250
20261
Protected by Waratek1
High1
blocked by ARMR today1
No public exploit1
201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-46581 | High | 2026-08-05 | Protected by Waratek | No public exploit | In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`. |
| CVE-2020-6950 | Medium | 2021-06-02 | Protected by Waratek | Working exploit published | Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter. |
| CVE-2019-17091 | Medium | 2019-10-02 | Protected by Waratek | No public exploit | faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled. |
| CVE-2018-14371 | High | 2018-07-18 | Protected by Waratek | No public exploit | The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications. |
| CVE-2013-5855 | Medium | 2014-07-17 | Protected by Waratek | No public exploit | Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors. |
| CVE-2012-2672 | Low | 2012-06-17 | No exploit published | No public exploit | Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function. |
| CVE-2010-4007 | Medium | 2010-10-20 | No exploit published | No public exploit | Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057. |
| CVE-2010-2087 | Medium | 2010-05-27 | No exploit published | No public exploit | Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object. |