Red Hat · JBoss RichFaces Framework
CVE-2018-14667
Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
What it is
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
CISA: Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: October 19, 2023
- Added to the CISA list
- September 28, 2023
- Published
- November 6, 2018
- Severity
- Critical 9.8 CVSS 3.0
- Chance of attacks in the next 30 days (EPSS)
- 74% in the top 0.5% of all known vulnerabilities
- Weakness
- CWE-94
- More details
- NVD · CVE.org · CISA
All references (8)
- https://access.redhat.com/errata/RHSA-2018:3519
- https://access.redhat.com/errata/RHSA-2018:3581
- https://access.redhat.com/errata/RHSA-2018:3518
- https://access.redhat.com/errata/RHSA-2018:3517
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667
- http://www.securitytracker.com/id/1042037
- http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html
- http://seclists.org/fulldisclosure/2020/Mar/21
More exploited flaws from Red Hat
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 26, 2026 | Race Condition | Libuser | High 7.4 | 8.5% |
| Aug 26, 2026 | Privilege Escalation | Automatic Bug Reporting Tool | High 7.8 | 5.0% |
| May 12, 2023 | Incorrect Authorization | Polkit | High 7.8 | 24% |
| Jun 27, 2022 | Out-of-Bounds Read and Write | Polkit | High 7.8 | 95% |
| May 25, 2022 | Authentication Bypass | JBoss | Low 3.7 | 74% |
| May 25, 2022 | Information Disclosure | JBoss | Medium 5.9 | 53% |
| Dec 10, 2021 | Linux JBoss Seam 2 Remote Code Execution | JBoss Seam 2 | High 8.8 | 83% |
| Dec 10, 2021 | Remote Code Execution | JBoss Application Server | Critical 9.8 | 91% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.