Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

GHSA-4j38-wjhf-884r

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-4j38-wjhf-884r

Arbitrary code execution in Richfaces JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.

gitlab/maven/org.richfaces/richfaces-core/CVE-2018-12533

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.