Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2018-12533

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-4j38-wjhf-884r

Arbitrary code execution in Richfaces JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.

gitlab/maven/org.richfaces/richfaces-a4j/CVE-2018-12533

Code Injection JBoss RichFaces allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code.

gitlab/maven/org.richfaces/richfaces-core/CVE-2018-12533

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.