CVE-2011-4367

Apache MyFaces Core <2.0.12, <2.1.6 - Path Traversal

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2011-4367. PoCs published by Paul Nicolucci, dawetmaster, andikahilmy.

AI-analyzed exploit summary This exploit demonstrates a path traversal vulnerability in Apache MyFaces, allowing remote attackers to disclose sensitive files like web.xml by manipulating the 'ln' parameter in resource requests.

Description

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.

Exploits (4)

exploitdb WORKING POC VERIFIED
by Paul Nicolucci · textremotemultiple
https://www.exploit-db.com/exploits/36681

This exploit demonstrates a path traversal vulnerability in Apache MyFaces, allowing remote attackers to disclose sensitive files like web.xml by manipulating the 'ln' parameter in resource requests.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Apache MyFaces 2.0.1-2.0.11, 2.1.0-2.1.5
No auth needed
Prerequisites: Access to the target web application
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec STUB
by dawetmaster · poc
https://github.com/dawetmaster/CVE-2011-4367-myfaces-vulnerable

The repository contains only API source files from the MyFaces project, which are part of the vulnerable codebase but do not include any exploit code or proof-of-concept. The files are legitimate components of the MyFaces framework but do not demonstrate or exploit CVE-2011-4367.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Apache MyFaces
No auth needed
Prerequisites: None
devstral-2 · analyzed Mar 14, 2026 Full analysis →
nomisec WRITEUP
by andikahilmy · poc
https://github.com/andikahilmy/CVE-2011-4367-myfaces-vulnerable

This repository contains source code files from the Apache MyFaces project, specifically focusing on the vulnerable components related to CVE-2011-4367. The files include core classes like FactoryFinder and FacesException, which are part of the JSF (JavaServer Faces) API. The repository appears to be a snapshot of the vulnerable codebase rather than an exploit or scanner.

Classification
Writeup 90%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: Apache MyFaces (JSF implementation)
No auth needed
Prerequisites: Access to vulnerable MyFaces deployment
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by shoucheng3 · poc
https://github.com/shoucheng3/apache__myfaces_CVE-2011-4367_2-0-11

The repository appears to be a legitimate Apache MyFaces project with no exploit code. It contains TypeScript API definitions and documentation but lacks any proof-of-concept exploit for CVE-2011-4367.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Apache MyFaces
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (6)

Core 6
Core References
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2012/Feb/150
Broken Link vdb-entry x_refsource_osvdb
http://osvdb.org/show/osvdb/79002
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/73100
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/47973
Exploit, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/51939

Scores

EPSS 0.8592
EPSS Percentile 99.4%

Details

CWE
CWE-22
Status published
Products (2)
apache/myfaces 2.0.1 - 2.0.11
org.apache.myfaces.core/myfaces-impl 2.0.0 - 2.0.12Maven
Published Jun 19, 2014
Tracked Since Feb 18, 2026