CVE-2020-6950 Eclipse Mojarra
| Affected software | Eclipse Mojarra |
|---|---|
| Severity | 6.5 Medium CVSS 3.1 2 scores |
| Fixed in | 2.3.14 |
| Weakness | Path traversal (CWE-22) |
| Published | 2 Jun 2021 |
| Updated | 13 Nov 2026 |
Description
Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
Exploitation status
Working exploit published
A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment no assessment published
- Indexed PoC 2 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2026-09-02.
- EPSS 10% chance in 30 days A model's forecast, not a report of exploitation. Higher than 96% of all scored CVEs.
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | CVE-2020-6950 backport for legacy Mojarra 2.2.13 | 2026-09-02 | |
| Nuclei | Eclipse Mojarra - Local File Read |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Path traversal
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Path Traversal. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: Path Traversal
How to mitigate CVE-2020-6950
Upgrade Eclipse Mojarra to 2.3.14 or later. Until you can, Waratek RASP blocks exploitation with its path traversal rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
6.5 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
2 metrics
CVSS
6.5 MEDIUM v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
NVD | Primary | published |
| CVSS 2.0 | 4.3 | none | AV:N/AC:M/Au:N/C:P/I:N/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2023 ↗ | CPU | 2023-Q2 | Oracle Fusion Middleware / Third Party (Eclipse Mojarra) (12.2.1.3.0, 12.2.1.4.0) |
| Oracle Critical Patch Update October 2022 ↗ | CPU | 2022-Q4 | Oracle Communications / Platform (Eclipse Mojarra) (12.4.0) Oracle Retail Applications / Other (Eclipse Mojarra) (15.0.2, 16.0.2) |
| Oracle Critical Patch Update April 2022 ↗ | CPU | 2022-Q2 | Oracle Communications Applications / Installer (Eclipse Mojarra) (7.3.6) Oracle Hyperion / General (Eclipse Mojarra) (Prior to 11.2.8.0) Oracle Systems / Tools (Eclipse Mojarra) (4) |
| Oracle Critical Patch Update January 2022 ↗ | CPU | 2022-Q1 | Oracle E-Business Suite / Timecard (Eclipse Mojarra) (12.2.6-12.2.11) |
| Oracle Critical Patch Update October 2021 ↗ | CPU | 2021-Q4 | Oracle Communications Applications / Services Manager (Eclipse Mojarra) (12.0.0.3.0) Oracle Financial Services Applications / Collections (Eclipse Mojarra) (2.10.0, 2.12.0) Oracle Financial Services Applications / Investment Account (Eclipse Mojarra) (2.6.2, 2.7.1, 2.9.0, 2.12.0) Oracle Retail Applications / Foundation (Eclipse Mojarra) (19.0.1) |
| Oracle Critical Patch Update January 2020 ↗ | CPU | 2020-Q1 | Oracle Fusion Middleware / Web Container (JavaServer Faces) (12.2.1.3.0, 12.2.1.4.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | Platform (Eclipse Mojarra) | 12.4.0 | 12.4.0 |
| Oracle Communications Applications | Installer (Eclipse Mojarra) | 7.3.6 | 7.3.6 |
| Oracle Communications Applications | Services Manager (Eclipse Mojarra) | 12.0.0.3.0 | 12.0.0.3.0 |
| Oracle E-Business Suite | Timecard (Eclipse Mojarra) | 12.2.6-12.2.11 | |
| Oracle Financial Services Applications | Collections (Eclipse Mojarra) | 2.10.0, 2.12.0 | 2.10.0 · 2.12.0 |
| Oracle Financial Services Applications | Investment Account (Eclipse Mojarra) | 2.6.2, 2.7.1, 2.9.0, 2.12.0 | 2.6.2 · 2.7.1 · 2.9.0 · 2.12.0 |
| Oracle Fusion Middleware | Third Party (Eclipse Mojarra) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Fusion Middleware | Web Container (JavaServer Faces) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Hyperion | General (Eclipse Mojarra) | Prior to 11.2.8.0 | |
| Oracle Retail Applications | Foundation (Eclipse Mojarra) | 19.0.1 | 19.0.1 |
| Oracle Retail Applications | Other (Eclipse Mojarra) | 15.0.2, 16.0.2 | 15.0.2 · 16.0.2 |
| Oracle Systems | Tools (Eclipse Mojarra) | 4 | 4 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.glassfish:mojarra-parent |
0 | 2.3.14 |
unbounded |
Products and versions
10 products, 14 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | eclipse | mojarra | generic | ＜ 2.3.14 |
| nvd | oracle | banking enterprise default management | generic | 2.10.0 · 2.12.0 |
| nvd | oracle | banking platform | generic | 2.6.2 · 2.7.1 · 2.9.0 · 2.12.0 |
| nvd | oracle | communications network integrity | generic | 7.3.6 |
| nvd | oracle | communications pricing design center | generic | 12.0.0.3.0 |
| nvd | oracle | hyperion calculation manager | generic | ＜ 11.2.8.0 |
| nvd | oracle | retail merchandising system | generic | 19.0.1 |
| nvd | oracle | solaris cluster | generic | 4.0 |
| nvd | oracle | time and labor | generic | ≥ 12.2.6 and ≤ 12.2.11 |
| osv | org.glassfish | mojarra-parent | generic | ＜ 2.3.14 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, WEB CONTAINER (JAVASERVER FACES), NO AUTH REMOTE EXPLOIT, SERVICES MANAGER (ECLIPSE MOJARRA), COLLECTIONS (ECLIPSE MOJARRA), INVESTMENT ACCOUNT (ECLIPSE MOJARRA), FOUNDATION (ECLIPSE MOJARRA), TIMECARD (ECLIPSE MOJARRA) **Products:** ORACLE WEBLOGIC SERVER, MOJARRA, ORACLE FUSION MIDDLEWARE, ORACLE COMMUNICATIONS PRICING DESIGN CENTER, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE BANKING ENTERPRISE DEFAULT MANAGEMENT, ORACLE FINANCIAL SERVICES APPLICATIONS, ORACLE BANKING PLATFORM, ORACLE RETAIL APPLICATIONS, ORACLE RETAIL MERCHANDISING SYSTEM, ORACLE TIME AND LABOR, ORACLE E-BUSINESS SUITE
References
Timeline
Timeline
| Published | 2021-06-02 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |