Read the docs
TI-2012-02309 Aliases CVE-2012-2672GHSA-78gp-c2rq-6jhr

Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during…

Priority LOW 12Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function.

Why it matters now

EPSS 0.00545 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:oracle:mojarra:2.1.7:*:*:*:*:*:*:*2.1.7VulnerableOracle
  • cpe:2.3:a:oracle:mojarra:2.1.7:*:*:*:*:*:*:* Versions 2.1.7 Vulnerable ·Oracle

Remediation

Red Hat 3 advisories

  • RHSA-2012:1594 Released 2012-12-18 · Red Hat rating Important
    JBoss Enterprise Application Platform 6.0.1 update
    • Red Hat JBoss Enterprise Application Platform 6.0
  • RHSA-2012:1592 Released 2012-12-18 · Red Hat rating Important
    JBoss Enterprise Application Platform 6.0.1 update
    • Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server antlr-eap6-2.7.7-15_redhat_2.ep6.el6, apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el6, apache-commons-cli-1.2-7.5.redhat_2.ep6.el6.4 +47
  • RHSA-2012:1591 Released 2012-12-18 · Red Hat rating Important
    JBoss Enterprise Application Platform 6.0.1 update
    • Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server antlr-eap6-2.7.7-15_redhat_2.ep6.el5, apache-commons-beanutils-1.8.3-10.redhat_2.ep6.el5, apache-commons-cli-1.2-7.5.redhat_2.ep6.el5.4 +47

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 ServerFixed RHSA-2012:1591
Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 ServerFixed RHSA-2012:1592
Red Hat JBoss Enterprise Application Platform 6.0Fixed RHSA-2012:1594

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-2672
  2. 2026-10-03 Alias added: GHSA-78gp-c2rq-6jhr

References

Exploit 1

Advisory 3

Other 3

  • TI-2013-04991 Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate… CVSS 2.0MEDIUM 4.3
  • TI-2010-03800 Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC)… CVSS 2.0MEDIUM 5.0
  • TI-2010-01999 Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences