ACTIEF MISBRUIKT
CVE-2018-14667: Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
| Leverancier | Red Hat |
|---|---|
| Product | JBoss RichFaces Framework |
| Actief misbruikt | Ja |
| Toegevoegd aan CISA KEV | 28 sep 2023 |
| CISA-deadline (Amerikaanse overheid) | 19 okt 2023 |
| Zwakte (CWE) | CWE-94 |
Vereiste actie (tekst van CISA, Engels)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Beschrijving (NVD, Engels)
Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
BRONNEN
Andere lekken bij Red Hat
- CVE-2015-5287: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
- CVE-2015-3246: Red Hat Libuser Race Condition Vulnerability
- CVE-2021-3560: Red Hat Polkit Incorrect Authorization Vulnerability
- CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
- CVE-2010-1428: Red Hat JBoss Information Disclosure Vulnerability
Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.