Red Hat RichFaces vulnerabilities
6 CVEs affecting Red Hat RichFaces, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-14667, published 2018-11-06.
More from Red Hat.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2018-14667: Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability, published 2018-11-06. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-09-28. EPSS: 74.2% chance of exploitation in the next 30 days. The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary…
- CVE-2018-12533, published 2018-06-18. Critical severity, CVSS 9.8. EPSS: 19% chance of exploitation in the next 30 days. JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an…
- CVE-2013-2165, published 2013-07-23. High severity, CVSS 7.5. EPSS: 12.7% chance of exploitation in the next 30 days. ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise…
- CVE-2018-12532, published 2018-06-18. Critical severity, CVSS 9.8. EPSS: 7% chance of exploitation in the next 30 days. JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a…
- CVE-2015-0279, published 2015-03-26. Medium severity, CVSS 6.8. EPSS: 3.9% chance of exploitation in the next 30 days. JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.
- CVE-2014-0086, published 2014-03-31. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a…