CVE-2018-14667: Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
Vulnerability summary
CVE-2018-14667 is a critical (CVSS 9.8) Code Injection vulnerability in Red Hat JBoss RichFaces Framework. It is known to be exploited: CISA lists it, first on 28-09-2023. EPSS estimates a 74.20% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities.
Timeline
- 06-11-2018PublishedVulnerability first disclosed.
- 28-09-2023Added to CISA KEVRed Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
- 19-10-2023CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 21-10-2025Last modifiedVulnerability information updated.
Description
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
CVSS metrics
6 scores · 4 sources · 3 versions- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
- NVDNIST9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
74.20%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
+0.03 pp
From 74.17% on 18-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 28-09-2023
- Federal due date
- 19-10-2023
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667 nvd.nist.gov/vuln/detail/CVE-2018-14667
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat9 products
- enterprise_linuxEOL5.0 | 6.0
- richfaces≥ 3.1.0, ≤ 3.3.4
- richfaces< 0:3.3.1-9.SP3_patch_03.ep5.el5 | < 0:3.3.1-6.SP3_patch_03.ep5.el6
- richfaces-cdk< 0:3.3.1-9.SP3_patch_03.ep5.el5
- richfaces-demo< 0:3.3.1-9.SP3_patch_03.ep5.el5 | < 0:3.3.1-6.SP3_patch_03.ep5.el6
[unknown]1 product
- richfacesaffected 3.X through 3.3.4
Org.richfaces1 product
- richfaces-core< 3.3.4
3 vendors · 11 products
References
20 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667X Refsource CONFIRMIssue TrackingVendor AdvisoryWEB
- packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.htmlX Refsource MISCThird Party AdvisoryVDB EntryWEB
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14667Government ResourceUS Government ResourceWEB
