Risk Letters

Exploited vulnerability

CVE-2018-14667

TLP:CLEAR

Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability

Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Facts

  • Vendor: Red Hat
  • Product: JBoss RichFaces Framework
  • CVSS: 9.8
  • EPSS (probability of exploitation within 30 days): 74.2 %
  • On CISA's Known Exploited Vulnerabilities list since: 28 September 2023
  • First known exploitation: 28 September 2023
  • CISA's deadline for US federal agencies: 19 October 2023
  • Weakness: CWE-94
  • First seen by Risk Letters: 28 September 2023

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD