CVE-2020-6950: Eclipse Mojarra

Medium severity, CVSS 6.5. EPSS: 10.1% chance of exploitation in the next 30 days.

Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.

Affected products

• Eclipse Mojarra: before 2.3.14 (fixed in 2.3.14)
• Oracle Banking Enterprise Default Management: version 2.10.0 only; version 2.12.0 only
• Oracle Banking Platform: version 2.6.2 only; version 2.7.1 only; version 2.9.0 only; version 2.12.0 only
• Oracle Communications Network Integrity: version 7.3.6 only
• Oracle Communications Pricing Design Center: version 12.0.0.3.0 only
• Oracle Hyperion Calculation Manager: before 11.2.8.0 (fixed in 11.2.8.0)
• Oracle Retail Merchandising System: version 19.0.1 only
• Oracle Solaris Cluster: version 4.0 only
• Oracle Time And Labor: from 12.2.6, up to and including 12.2.11

Published 2021-06-02. Last modified 2026-06-17.