CVE-2018-14667

Produto

Red Hat / JBoss RichFaces Framework

Vulnerabilidade

Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability

Adicionado ao KEV

28 de set. de 2023

Corrigir até

19 de out. de 2023

Uso conhecido em ransomware

Não

Descrição resumida

Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Ação necessária

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667; https://nvd.nist.gov/vuln/detail/CVE-2018-14667