CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2018-11-06
Red Hat RichFaces 3.X Expression Language (EL) Injection and Remote Code Execution (RCE) Vulnerability (CVE-2018-14667)
[Affected Scope] All Java-based web applications utilizing RichFaces Framework versions 3.0.0 through 3.3.4.
[Impact] A remote, unauthenticated attacker can execute arbitrary system commands and fully compromise the host by sending a crafted chain of serialized Java objects.
[Mitigation] Migrate legacy RichFaces 3.X applications to supported frameworks, or restrict external access to the vulnerable '/org.ajax4jsf.resource.UserResource' path using WAF rules or servlet filters.