Skip to content
OpenAdvisories

Package · Maven

org.richfaces:richfaces-core

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.8
    CVE-2018-14667 Exploited Public exploit EPSS 74%

    Richfaces vulnerable to arbitrary code execution

    The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4…

    [UNKNOWN] RichFaces org.richfaces:richfaces-core Maven
    KEV Sep 28, 2023
  • Critical 9.8
    CVE-2018-12532

    RichFaces vulnerable to Expression Language Injection

    JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309.

    org.richfaces:richfaces-core Maven
  • Critical 9.8
    CVE-2018-12533 Public exploit EPSS 19%

    Arbitrary code execution in Richfaces

    JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, …

    org.richfaces:richfaces-core Maven