CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1–1 of 1 advisories (Page 1/1)
2018-01-03
Primetek PrimeFaces 5.x Remote Code Execution (RCE) via Weak Encryption Flaw (CVE-2017-1000486)
[Affected Scope] Java web applications utilizing Primetek PrimeFaces framework version 5.x and below
[Impact] Unauthenticated remote attackers can exploit weak encryption keys to inject arbitrary serialized objects, leading to Remote Code Execution (RCE) on the target server
[Mitigation] Upgrade PrimeFaces to a secure version (6.0 or higher) and configure a strong, unique custom secret key in web.xml