Actively exploited · Published Jan 3, 2018 · Assigned by mitre
CVE-2017-1000486
Critical 9.8 Exploited
In plain English
A critical-severity security flaw in Primefaces Application from Primetek. Attackers are actively exploiting it in the wild (listed by CISA on January 10, 2022). The chance it is exploited in the next 30 days is estimated at 94.1% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jul 10, 2022.
Official description
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.primefaces:primefaces | 6.0 | GHSA-j239-4gqg-5j54 |
Affected products (as reported)
Weakness: CWE-326 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/primefaces/primefaces/issues/1152 x_refsource_CONFIRM
- https://cryptosense.com/weak-encryption-flaw-in-primefaces/ x_refsource_MISC
- http://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html x_refsource_MISC
- 43733 exploit, x_refsource_EXPLOIT-DB
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-1000486 government-resource