by Kastro
Paper/Archive/CVE-2018-14667

CVE-2018-14667

[UNKNOWN] RichFaces — Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability

KEV · due 19 OctEPSS 74%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.5.995 × 2019.9Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Affected

ProductAffectedFixed inSource
RichFacesaffected 3.X through 3.3.4–CNA

Scores by source

redhat (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refbugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667advisoryaccess.redhat.com/errata/RHSA-2018:3519advisoryaccess.redhat.com/errata/RHSA-2018:3581advisoryaccess.redhat.com/errata/RHSA-2018:3518advisoryaccess.redhat.com/errata/RHSA-2018:3517refsecuritytracker.com/id/1042037refpacketstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.htmlrefseclists.org/fulldisclosure/2020/Mar/21refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14667kevcisa.gov/known-exploited-vulnerabilities-catalog