CVE-2018-14667criticalunder attackCWE-94

CVE-2018-14667: critical vulnerability in [UNKNOWN] RichFaces

Published · Updated

Follow this CVE+ Monitor JBoss RichFaces Framework+ Monitor org.richfaces:richfaces-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.8epss 74%
from disclosure to weapon12 days
Published on NVDNov 6
1st PoC+12d
CISA KEV+1787d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product
JBoss Developer Studio 11
no_fix_planned: Out of support scope
Fixed
5 products (17 components)
Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server · Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server · JBoss Enterprise BRMS Platform 5.3 · Red Hat JBoss EAP 5 · Red Hat JBoss SOA Platform 5.3
fix ↗
Not affected
1 product — because the vulnerable code is not present in the product
Red Hat JBoss Operations Network 3
Action required by CISAfederal deadline: 2023-10-19

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

RichFaces Framework versions 3.x through 3.3.4 contain a vulnerability that allows an unauthenticated attacker to inject malicious code through the UserResource feature, potentially taking complete control of the affected system.

Technical detail

The vulnerability is an Expression Language (EL) injection flaw in org.ajax4jsf.resource.UserResource$UriData that accepts untrusted user input without proper validation. An unauthenticated remote attacker can exploit this via a crafted request containing a serialized Java object chain to execute arbitrary code on the server.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
[UNKNOWN] · RichFaces
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.