Skip to content
Fencer Intel
critical 9.8

CVE-2018-14667 kev in the critical feed json

Richfaces vulnerable to arbitrary code execution

published 8y ago modified 4mo ago also GHSA-j7mw-7crr-658v , EUVD-2022-4307

cvss
9.8
version 3.0, CNA
cisa kev
Exploited
added 2023-09-28
epss
74.2%
EPSS 74.2% chance of exploitation in 30 days, percentile 99.4%
public exploits
0
none known

Summary

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Patch / fix

cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  • maven org.richfaces:richfaces-core 3.3.4
  • richfaces jboss enterprise application platform 5 3.3.1-9.SP3_patch_03.ep5.el5
  • richfaces jboss enterprise application platform 5 3.3.1-6.SP3_patch_03.ep5.el6
  • richfaces-ui jboss enterprise application platform 5 3.3.1-9.SP3_patch_03.ep5.el5
  • richfaces-ui jboss enterprise application platform 5 3.3.1-6.SP3_patch_03.ep5.el6
  • richfaces-cdk jboss enterprise application platform 5 3.3.1-9.SP3_patch_03.ep5.el5
  • richfaces-demo jboss enterprise application platform 5 3.3.1-9.SP3_patch_03.ep5.el5
  • richfaces-demo jboss enterprise application platform 5 3.3.1-6.SP3_patch_03.ep5.el6
  • richfaces-root jboss enterprise application platform 5 3.3.1-9.SP3_patch_03.ep5.el5

red hat advisories RHSA-2018:3517

Is CVE-2018-14667 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-14667 updated cvss 9.8

RichFaces: Expression Language injection via UserResource allows for unauthenticated remote code execution

  • Red Hat JBoss Developer Studio 11 RichFaces RichFaces
    affected: no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise BRMS Platform 5.3
    fixed: vendor fix RHSA-2018:3581
  • Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server richfaces 3.3.1-9.SP3_patch_03.ep5.el5, richfaces-ui 3.3.1-9.SP3_patch_03.ep5.el5, richfaces-cdk 3.3.1-9.SP3_patch_03.ep5.el5, richfaces-demo 3.3.1-9.SP3_patch_03.ep5.el5, richfaces-root 3.3.1-9.SP3_patch_03.ep5.el5, richfaces-framework 3.3.1-9.SP3_patch_03.ep5.el5 Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server richfaces 3.3.1-6.SP3_patch_03.ep5.el6, richfaces-ui 3.3.1-6.SP3_patch_03.ep5.el6, richfaces-demo 3.3.1-6.SP3_patch_03.ep5.el6, richfaces-root 3.3.1-6.SP3_patch_03.ep5.el6, richfaces-framework 3.3.1-6.SP3_patch_03.ep5.el6
    fixed: vendor fix RHSA-2018:3517
  • Red Hat JBoss Enterprise Application Platform 5.2
    fixed: vendor fix RHSA-2018:3518
  • Red Hat JBoss SOA Platform 5.3
    fixed: vendor fix RHSA-2018:3519
  • Red Hat JBoss Operations Network 3 RichFaces RichFaces
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. Added to CISA KEV
  3. CISA patch deadline
  4. CISA SSVC: exploitation active

Known exploited

Added
3y ago
Patch by
2023-10-19 (3y ago)
Ransomware
Not known
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor, product
Red Hat, JBoss RichFaces Framework
CISA name
Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
last yr.

Exploit prediction

74.20% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

Affected packages

ecosystem package affected fixed in
maven org.richfaces:richfaces-core
<3.3.4
3.3.4

Affected products

  • [UNKNOWN] RichFaces

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.