9.8
Critique
CVE-2018-14667 Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-94
Description
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| RichFaces | Versions non publiées |