Every CVE Search/ Get API key

CVE-2018-12533

Arbitrary code execution in Richfaces

9.8 CriticalPublic exploitFix available

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

18.7%Up 10.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.

Record
CVE-2018-12533
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-917
Updated
2026-11-02
CVE List No score

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.

Record
CVE-2018-12533
Updated
2026-11-02
EUVDEUVD-2022-2391 No score

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.

Record
EUVD-2022-2391
Updated
2026-11-03
GitHub AdvisoriesGHSA-4j38-wjhf-884r 9.8

Arbitrary code execution in Richfaces

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.

Record
GHSA-4j38-wjhf-884r
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-917
Updated
2026-11-02
OSVGHSA-4j38-wjhf-884r 9.8

Arbitrary code execution in Richfaces

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.

Record
GHSA-4j38-wjhf-884r
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-917
Updated
2026-11-02
OSVRHSA-2018:2664 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2 security update

Record
RHSA-2018:2664
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.richfaces:richfaces-core
Maven
 3.1.0 to 3.3.4 None known
richfaces
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:3.3.1-7.SP3_patch_02.ep5.el5
0:3.3.1-7.SP3_patch_02.ep5.el5
richfaces-cdk
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:3.3.1-7.SP3_patch_02.ep5.el5
0:3.3.1-7.SP3_patch_02.ep5.el5
richfaces-demo
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:3.3.1-7.SP3_patch_02.ep5.el5
0:3.3.1-7.SP3_patch_02.ep5.el5
richfaces-docs
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:3.3.1-7.SP3_patch_02.ep5.el5
0:3.3.1-7.SP3_patch_02.ep5.el5
richfaces-framework
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:3.3.1-7.SP3_patch_02.ep5.el5
0:3.3.1-7.SP3_patch_02.ep5.el5
richfaces-root
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:3.3.1-7.SP3_patch_02.ep5.el5
0:3.3.1-7.SP3_patch_02.ep5.el5
richfaces-ui
Red Hat:jboss_enterprise_application_platform:5::el5
 before 0:3.3.1-7.SP3_patch_02.ep5.el5
0:3.3.1-7.SP3_patch_02.ep5.el5
richfaces
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:3.3.1-4.SP3_patch_02.ep5.el6_10
0:3.3.1-4.SP3_patch_02.ep5.el6_10
richfaces-demo
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:3.3.1-4.SP3_patch_02.ep5.el6_10
0:3.3.1-4.SP3_patch_02.ep5.el6_10
richfaces-framework
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:3.3.1-4.SP3_patch_02.ep5.el6_10
0:3.3.1-4.SP3_patch_02.ep5.el6_10
richfaces-root
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:3.3.1-4.SP3_patch_02.ep5.el6_10
0:3.3.1-4.SP3_patch_02.ep5.el6_10
richfaces-ui
Red Hat:jboss_enterprise_application_platform:5::el6
 before 0:3.3.1-4.SP3_patch_02.ep5.el6_10
0:3.3.1-4.SP3_patch_02.ep5.el6_10

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubLucasKatashi/paint2die2025-11-24
PoC in GitHubPastea/CVE-2018-125332021-11-08
PoC in GitHubarslanben/richfaces-paint2d-lab2026-10-01
PoC in GitHubllamaonsecurity/CVE-2018-125332018-12-15
PoC in GitHubmhagnumdw/richfaces-vulnerability-cve-2018-12533-rf-143102025-04-22

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-12533 is a critical vulnerability (CVSS 9.8) in Redhat Richfaces, published June 18, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 18.7%, the 97th percentile. Fixed in richfaces 0:3.3.1-7.SP3_patch_02.ep5.el5.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open