CVE-2015-0279: Code Injection
Published Feb 12, 2015
·Updated
It was reported [1] that remote attackers can inject EL (Expression Language) via "do" parameter. This leads to remote Java method execution vulnerability.
[1]: https://issues.jboss.org/browse/RF-13977
Other sources
JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.
— MITRE
Affected Software
2 affected componentsFixes available
redhat/RichFaces<4.5.4
4.5.4
redhat Richfaces>=4.0.0<=4.5.4
Event History
Mar 26, 2015
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-0279?
CVE-2015-0279 has a high severity level due to its potential for remote Java method execution.
2
Who is affected by CVE-2015-0279?
CVE-2015-0279 affects versions of JBoss RichFaces prior to 4.5.4.
3
How do I fix CVE-2015-0279?
To fix CVE-2015-0279, upgrade JBoss RichFaces to version 4.5.4 or later.
4
What type of vulnerability is CVE-2015-0279?
CVE-2015-0279 is classified as a remote code execution vulnerability.
5
What causes CVE-2015-0279?
CVE-2015-0279 is caused by the injection of Expression Language via the "do" parameter.