PT-2018-11239 · Red Hat · Jboss Richfaces

Publicado 2018-06-18 · Atualizado 2022-05-13 · CVE-2018-12532

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JBoss RichFaces versions 4.5.3 through 4.5.17

Description The issue allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request.

Recommendations For JBoss RichFaces versions 4.5.3 through 4.5.17, update to a version outside of the affected range to mitigate the risk of arbitrary Java code execution.

Exploit

Correção

Enumeração de Fraquezas

CWE-917

Identificadores relacionados

CVE-2018-12532

GHSA-3HX6-FQPJ-XFJR

Produtos afetados

Jboss Richfaces

Referências · 6

• 🔥 https://codewhitesec.blogspot.com/2018/05/poor-richfaces.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-12532 · Aviso do Fabricante
• http://securityfocus.com/bid/104503 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-12532 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-3hx6-fqpj-xfjr · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2020/Mar/21 · Nota