CVE-2018-14667
Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
Vulnerability Description
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Affected Platforms (CPE)
📦
Redhat
Richfaces
>= 3.1.0 and <= 3.3.4💻
Redhat
Enterprise Linux
= 5.0💻
Redhat