CVE-2018-14371: Eclipse Mojarra

High severity, CVSS 7.5. EPSS: 4.4% chance of exploitation in the next 30 days.

The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.

Affected products

• Eclipse Mojarra: before 2.3.7 (fixed in 2.3.7)

Published 2018-07-18. Last modified 2026-06-17.