# CVE Reservation Request --- ## CVE record information **Project name:** Eclipse Mojarra **Project id:** ee4j.mojarra **Versions affected:** [2.3, 5.0] <!-- Required (for publication). The Common Weakness Enumeration (CWE) code comes from here: https://cwe.mitre.org/, e.g., "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')". Multiple codes can be provided. --> **Common Weakness Enumeration (CWE):** - [cwe-22](https://cwe.mitre.org/data/definitions/22.html) - [cwe-94](https://cwe.mitre.org/data/definitions/94.html) - [cwe-641](https://cwe.mitre.org/data/definitions/641.html) **Common Attack Pattern Enumerations and Classifications (CAPEC):** - [capec-253](https://capec.mitre.org/data/definitions/253.html) **Summary:** In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`. <!-- Required (for publication). Include a link to the issue (e.g., GitHub Security Advisory) that's being used to track/resolve the issue. Other links that provide more information can be provided. For example, you may later publish the link to the fix commit. --> **Links:** - [Primary resolution link](https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/544) <!-- Quick actions will configure the state of the issue. Leave these. --> <!-- Keep this as the last line -->