Read the docs
TI-2018-10313 Aliases CVE-2018-14371GHSA-43q7-q5vp-3g68

The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is…

Priority MEDIUM 40CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 10 fixed, 9 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.

Why it matters now

EPSS 0.04425 91st percentileScored 2026-11-07
Fix Partial org.glassfish:mojarra-parent (Maven): 2.3.7Red Hat: 8 advisoriesRed Hat: 10 fixed, 9 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.glassfish:mojarra-parent (Maven)before 2.3.72.3.7Patch availableGHSA-43q7-q5vp-3g68
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.glassfish:mojarra-parent (Maven) Vendor— Affected before 2.3.7 Fixed in 2.3.7 Patch available GHSA-43q7-q5vp-3g68

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:mojarra:*:*:*:*:*:*:*:*before 2.3.7VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:mojarra:*:*:*:*:*:*:*:* Versions before 2.3.7 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · GHSA-43q7-q5vp-3g68 org.glassfish:mojarra-parent (Maven) Fixed in 2.3.7 Advisory →

Red Hat 8 advisories

  • RHSA-2020:3585 Released 2020-08-31 · Red Hat rating Important
    EAP Continuous Delivery Technical Preview Release 20 security update
    • EAP-CD 20 Tech Preview
  • RHSA-2020:2511 Released 2020-06-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el6eap +47
  • RHSA-2020:2512 Released 2020-06-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el7eap +47
Show 5 more Red Hat advisories
  • RHSA-2020:2513 Released 2020-06-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el8eap +47
  • RHSA-2020:2515 Released 2020-06-10 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2020:2113 Released 2020-05-12 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.8 security update
    • Red Hat Single Sign On 7.3
  • RHSA-2020:2063 Released 2020-05-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-glassfish-jsf-2.3.5-11.SP3_redhat_00009.1.el6eap, eap7-infinispan-9.3.9-1.Final_redhat_00001.1.el6eap, eap7-infinispan-cachestore-jdbc-9.3.9-1.Final_redhat_00001.1.el6eap +7
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-glassfish-jsf-2.3.5-11.SP3_redhat_00009.1.el7eap, eap7-infinispan-9.3.9-1.Final_redhat_00001.1.el7eap, eap7-infinispan-cachestore-jdbc-9.3.9-1.Final_redhat_00001.1.el7eap +7
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-glassfish-jsf-2.3.5-11.SP3_redhat_00009.1.el8eap, eap7-infinispan-9.3.9-1.Final_redhat_00001.1.el8eap, eap7-infinispan-cachestore-jdbc-9.3.9-1.Final_redhat_00001.1.el8eap +7
  • RHSA-2020:2062 Released 2020-05-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2 security update
    • Red Hat JBoss EAP 7.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
JBoss Developer Studio 11AffectedNo fix planned: Out of support scope
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Out of support scope
EAP-CD 20 Tech PreviewFixed RHSA-2020:3585
Red Hat JBoss EAP 7.2Fixed RHSA-2020:2062
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2020:2063
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2020:2063
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2020:2063
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2020:2513
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2020:2511
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2020:2512
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2020:2515
Red Hat Single Sign On 7.3Fixed RHSA-2020:2113

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-14371
  2. 2026-10-03 Alias added: GHSA-43q7-q5vp-3g68
  3. 2026-11-05 Fix available: Red Hat JBoss Enterprise Application Platform 7 · Red Hat

References

Patch 1

Advisory 2

Other 1

  • TI-2020-05602 Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary… CVSS 3.1MEDIUM 6.5
  • TI-2026-34243 Path traversal in Eclipse Mojarra CVSS 3.1HIGH 7.5
  • TI-2019-12748 faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences