CVE-2018-14667: Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Other sources
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.richfaces:richfaces-coreto a version that resolves this vulnerability.Fixed in 3.3.4
Event History
Frequently Asked Questions
What is the severity of CVE-2018-14667?
CVE-2018-14667 has been classified with a medium severity rating due to its potential to allow remote code execution.
How do I fix CVE-2018-14667?
To remediate CVE-2018-14667, upgrade JBoss RichFaces Framework to version 3.3.4 or later.
Who is affected by CVE-2018-14667?
CVE-2018-14667 affects users of Red Hat JBoss RichFaces Framework versions prior to 3.3.4.
What type of vulnerability is CVE-2018-14667?
CVE-2018-14667 is an expression language injection vulnerability that can be exploited to execute malicious code.
Can CVE-2018-14667 be exploited remotely?
Yes, CVE-2018-14667 can be exploited by remote, unauthenticated attackers.