9.8
Critical
CVE-2018-14667 Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Not observed so far
Weakness
CWE-94
Description
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| RichFaces | Versions not published |