Log in Start free

Actively exploited · Published Nov 6, 2018 · Assigned by redhat

CVE-2018-14667

Critical 9.8 Exploited

In plain English

A critical-severity code injection in RichFaces from [UNKNOWN]. Attackers are actively exploiting it in the wild (listed by CISA on September 28, 2023). The chance it is exploited in the next 30 days is estimated at 74.2% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.0)9.8Critical
Exploit odds (30 days)74.2%top 0.5% of all CVEs
Exploited in the wildYesCISA KEV since Sep 28, 2023
Attack tooling1Public PoC

CISA guidance

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Oct 19, 2023.

Official description

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.richfaces:richfaces-core3.3.4GHSA-j7mw-7crr-658v

Affected products (as reported)

VendorProductVersions
[UNKNOWN] RichFaces affected 3.X through 3.3.4

Weakness: CWE-94 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References