PT-2018-12653
CVE-2018-14667
·
Publicado
2018-11-06
·
Atualizado
2025-11-03
Descrição por
CVSS 3.1
9.8
CríticaMétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
RichFaces Framework versions 3.X through 3.3.4
Description
The RichFaces Framework is susceptible to Expression Language (EL) injection through the UserResource resource. A remote, unauthenticated attacker can potentially execute arbitrary code by exploiting a chain of Java serialized objects via
org.ajax4jsf.resource.UserResource$UriData. This issue is currently being exploited in attacks, as indicated by CISA advisories.Recommendations
Versions prior to 3.4 are affected.
Explorabilidade
Exploit
Correção
Impactos
Pesquisadores
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾