CVE-2017-1000486
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply updates per vendor instructions.
Primefaces 5.x uses weak encryption that allows attackers to bypass security controls and execute arbitrary code on the server. This is a critical vulnerability because it gives complete control of the application to an attacker.
Primefaces 5.x implements inadequate encryption (CWE-326) for sensitive data protection, enabling attackers to decrypt or manipulate encrypted values without authentication. This weak cryptographic implementation can be exploited to achieve remote code execution, resulting in complete system compromise.
The full analysis of this CVE is available in Portuguese →