PT-2018-11239

CVE-2018-12532

·

Published

2018-06-18

·

Updated

2022-05-13

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions JBoss RichFaces versions 4.5.3 through 4.5.17
Description The issue allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request.
Recommendations For JBoss RichFaces versions 4.5.3 through 4.5.17, update to a version outside of the affected range to mitigate the risk of arbitrary Java code execution.
Exploitability
Exploit
Fix
Vendors
Affected products
Weakness enumeration
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement (\'Expression Language Injection\')
Related identifiers
CVE-2018-12532
GHSA-3HX6-FQPJ-XFJR
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com