Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2011-4367

Quick assessment

Affected

n/a n/a

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache MyFaces是美国阿帕奇（Apache）软件基金会的一个项目，它实现了JavaServer Faces（JSF，一个用于构建Web应用程序的标准Java框架）。Core是其中的一个实现了JSF 1.1、JSF 1.2、JSF 2.0和JSF 2.1规范的子项目。 Apache MyFaces Core 2.0.0至2.0.111 版本和2.1.0至2.1.5版本的MyFaces JSF中存在目录遍历漏洞，该漏洞源于faces/javax.faces.resource/web.xml页面没有

AI Predicted 7.5 Difficulty: Easy EPSS 33.75% · P98 Updated Feb 21, 2026

Public Exploits 1

ExploitDB · 1 EDB-36681 [remote]

Possible ATT&CK Techniques 1 AI

T1079

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2011-4367

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Apache MyFaces Core ‘ln’ 参数目录遍历漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	n/a	n/a	-

II. Public POCs for CVE-2011-4367

#	POC Description	Source Link	Shenlong Link
1	None	https://github.com/shoucheng3/apache__myfaces_CVE-2011-4367_2-0-11	POC Details
2	None	https://github.com/andikahilmy/CVE-2011-4367-myfaces-vulnerable	POC Details

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2011-4367

请登录查看更多情报信息。

Vendor Advisories for CVE-2011-4367 (4)

http://osvdb.org/show/osvdb/79002 vdb-entry x_refsource_OSVDB
http://www.securityfocus.com/bid/51939 vdb-entry x_refsource_BID
http://secunia.com/advisories/47973 third-party-advisory x_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilities/73100 vdb-entry x_refsource_XF

Mailing List Discussions for CVE-2011-4367 (2)

http://seclists.org/fulldisclosure/2012/Feb/150 mailing-list x_refsource_FULLDISC
http://mail-archives.apache.org/mod_mbox/myfaces-announce/201202.mbox/%3C4F33ED1F.4070007%40apache.org%3E mailing-list x_refsource_MLIST

https://www.cve.org/CVERecord?id=CVE-2011-4367

Same Patch Batch · n/a · 2014-06-19 · 19 CVEs total

CVE-2014-4334		Ubisoft Rayman Legends 基于栈的缓冲区溢出漏洞
CVE-2014-4329		ntopng‘lua/host_details.lua’跨站脚本漏洞
CVE-2014-2962		Belkin N150 F9K1009 绝对路径遍历漏洞
CVE-2014-2782		Microsoft Internet Explorer 内存损坏漏洞
CVE-2014-2611		HP Executive Scorecard 目录遍历漏洞
CVE-2014-2610		HP Executive Scorecard 目录遍历漏洞
CVE-2014-2609		HP Executive Scorecard 授权问题漏洞
CVE-2014-2001		East Japan Railway Company JR East Japan for Android 加密问题漏洞
CVE-2014-4335		Real Time Logic BarracudaDrive 跨站脚本漏洞
CVE-2012-2052		Adobe Photoshop CS5 ‘U3D.B8I’ 缓冲区溢出漏洞
CVE-2014-4333		Boonex Dolphin 跨站请求伪造漏洞
CVE-2014-4155		ZTE ZXV10 W300 跨站请求伪造漏洞
CVE-2014-3810		BoonEx Dolphin SQL注入漏洞
CVE-2014-3778		ARRIS SBG901 SURFboard Wireless Cable Modem 跨站请求伪造漏洞
CVE-2012-2572		Wordpress ThreeWP Email Reflector插件‘Subject’字段'跨站脚本漏洞
CVE-2012-2569		Synametrics Technologies Xeams Email Server ‘Body’字段跨站脚本漏洞
CVE-2012-1621		Apache Open For Business Project 跨站脚本漏洞
CVE-2013-1068		OpenStack Nova和Openstack Cinder 提权漏洞

IV. Related Vulnerabilities

Same product: n/a

Same vendor: n/a

V. Comments for CVE-2011-4367

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2011-4367

Quick assessment

Public Exploits 1

Possible ATT&CK Techniques 1 AI

I. Basic Information for CVE-2011-4367

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Shenlong Deep Dive — AI Deep Analysis

Affected Products

II. Public POCs for CVE-2011-4367

III. Intelligence Information for CVE-2011-4367

Vendor Advisories for CVE-2011-4367 (4)

Mailing List Discussions for CVE-2011-4367 (2)

Same Patch Batch · n/a · 2014-06-19 · 19 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2011-4367

Leave a comment