Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-j7mw-7crr-658v
Advisory ID github_osv/GHSA-j7mw-7crr-658v
Aliases CVE-2018-14667
Summary Richfaces vulnerable to arbitrary code execution The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via `org.ajax4jsf.resource.UserResource$UriData`.
Status Published
Exploitability 0.5
Weighted Severity 8.8
Risk 4.4
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-94 Improper Control of Generation of Code ('Code Injection')
System Score Found at
cvssv3.1 9.8 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-j7mw-7crr-658v/GHSA-j7mw-7crr-658v.json
generic_textual CRITICAL
Reference id Reference type URL
https://github.com/richfaces/richfaces/commit/1372eb716c1a215a5af124198f21bde33fafad06
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14667
21 Mailing List http://seclists.org/fulldisclosure/2020/Mar/21
CVE-2018-14667 https://nvd.nist.gov/vuln/detail/CVE-2018-14667
RHSA-2018:3517 Advisory https://access.redhat.com/errata/RHSA-2018:3517
RHSA-2018:3518 Advisory https://access.redhat.com/errata/RHSA-2018:3518
RHSA-2018:3519 Advisory https://access.redhat.com/errata/RHSA-2018:3519
RHSA-2018:3581 Advisory https://access.redhat.com/errata/RHSA-2018:3581
Richsploit-RichFaces-Exploitation-Toolkit.html Other http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html
show_bug.cgi?id=CVE-2018-14667 Other https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667
Data source KEV
Date added Sept. 28, 2023
Description Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due date Oct. 19, 2023
Note 
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667; https://nvd.nist.gov/vuln/detail/CVE-2018-14667
Ransomware campaign use Unknown

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-j7mw-7crr-658v/GHSA-j7mw-7crr-658v.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T13:30:40Z/

Decision: Act

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2018/14xxx/CVE-2018-14667.json

Source Advisory: vulnrichment/CVE-2018-14667

View SSVC decision tree 
[{'Exploitation': 'active'},
 {'Automatable': 'yes'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]