In Eclipse Mojarra version 2.3, the DefaultFaceletFactory component does not properly sanitize or restrict remote URLs. This allows an attacker to specify a URL to a remote Facelet resource, which the server then includes and processes as part of the request with the server's privileges. This improper limitation of pathname to a restricted directory (CWE-22) can lead to unauthorized access to sensitive files like WEB-INF/web.xml or /etc/passwd. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

An attacker can remotely exploit this vulnerability without authentication or user interaction to cause the server to include and process remote Facelet resources. This can lead to unauthorized disclosure of sensitive files on the server, such as configuration files or system password files, compromising confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published by the Eclipse Foundation at this time. Users should monitor the vendor advisory for updates and consider restricting or validating URL inputs to the DefaultFaceletFactory as a precaution.