Mojarra Vulnerable Due to Improper Cleanup of FacesContext Reference

CVE-2012-2672

Summary

Oracle Mojarra version 2.1.7 has a vulnerability where the FacesContext reference is not adequately cleaned during initialization. This flaw allows local users to gain access to sensitive context information, enabling them to access resources belonging to other deployed web applications through the FacesContext.getCurrentInstance method. As a result, attackers could exploit this oversight to potentially read or manipulate data between distinct WAR files, posing a significant security risk for applications utilizing this version of Mojarra.

References