9.8Kritik KEV

CVE-2018-14667Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability

[UNKNOWN] RichFaces Yayım: 2018-11-07 01:00 (8 yıl önce)

Aktif olarak istismar ediliyor — Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 28.09.2023 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 19.10.2023.

Gerekli işlem: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667; https://nvd.nist.gov/vuln/detail/CVE-2018-14667

Açıklama

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Zayıflık türü (CWE): CWE-94

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
redhat	enterprise linux	5.0
redhat	richfaces	3.1.0 – ≤ 3.3.4
—	RichFaces	affected 3.X through 3.3.4

Kaynaklar ve yamalar

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667 Issue TrackingVendor Advisory
RHSA-2018:3519 vendor-advisoryVendor Advisory
RHSA-2018:3581 vendor-advisoryVendor Advisory
RHSA-2018:3518 vendor-advisoryVendor Advisory
RHSA-2018:3517 vendor-advisoryVendor Advisory
1042037 vdb-entryThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html Third Party AdvisoryVDB Entry
20200313 RichFaces exploitation toolkit mailing-listMailing ListThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14667 US Government Resource

CPE eşleşmeleri (NVD) (3)

cpe:2.3:a:redhat:richfaces:*:*:*:*:*:*:*:* ≥ 3.1.0 ≤ 3.3.4
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

CVSS puanı

9.8Kritik

Kaynak: redhat · CVSS 3.0

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yüksek

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tüm puanlar (4)

cna	CVSS 3.0	9.8Kritik
nvd	CVSS 3.1	9.8Kritik
secalert@redhat.com	CVSS 3.0	9.8Kritik
nvd	CVSS 2.0	7.5Yüksek

EPSS (30 günde istismar olasılığı)

70.80%

tüm CVE'lerin %99'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: active
Otomatikleştirilebilir: yes
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2018-07-27
Yayımlandı2018-11-07 01:00
IP-DB'ye ulaştı2026-10-24 23:31
KEV'e eklendi2023-09-28
Son güncelleme2026-06-17 04:41

Numarayı veren (CNA): redhat
NVD durumu: Analyzed

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Red Hat Enterprise Linux

6.2Orta

CVE-2026-128886 dün

Dbus: server accept watch can be stalled by blocking nonce-tcp accept_with_noncefile path

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because th…

5.5Orta

CVE-2026-110330 dün

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8Yüksek

CVE-2026-110331 dün

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…

6.2Orta

CVE-2026-128987 dün

Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors a…

5.5Orta

CVE-2026-128885 dün

Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize

Red Hat Red Hat Enterprise Linux 10

A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a…

8.8Yüksek

CVE-2026-18379 2 gün önce

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

Red Hat Red Hat Enterprise Linux 10

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize…