Every CVESearch/Get API key

CVE-2018-14667

Richfaces vulnerable to arbitrary code execution

9.8 CriticalIn KEVPublic exploitFix available

CVE-2018-14667 is a critical vulnerability (CVSS 9.8) in [unknown] Richfaces, published November 6, 2018. CISA lists it as known to be exploited, since September 28, 2023. EUVD reports exploitation since September 28, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 74.2%, the 99th percentile. Fixed in org.richfaces:richfaces-core 3.3.4.

What does this mean?
Severity
9.8 CriticalCVSS 3.0, CVE List
Exploit chance
74.2%EPSS, 99th percentile
Exploitation
ExploitedCISA KEV,
Fixed in
3.3.4org.richfaces:richfaces-core +12 more

Description

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

74.2%Up 58.3 points since Apr 14, 2021
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.richfaces:richfaces-core
Maven
before 3.3.4
3.3.4
richfaces
Red Hat:jboss_enterprise_application_platform:5::el5
before 0:3.3.1-9.SP3_patch_03.ep5.el5
0:3.3.1-9.SP3_patch_03.ep5.el5
richfaces-cdk
Red Hat:jboss_enterprise_application_platform:5::el5
before 0:3.3.1-9.SP3_patch_03.ep5.el5
0:3.3.1-9.SP3_patch_03.ep5.el5
richfaces-demo
Red Hat:jboss_enterprise_application_platform:5::el5
before 0:3.3.1-9.SP3_patch_03.ep5.el5
0:3.3.1-9.SP3_patch_03.ep5.el5
richfaces-docs
Red Hat:jboss_enterprise_application_platform:5::el5
before 0:3.3.1-9.SP3_patch_03.ep5.el5
0:3.3.1-9.SP3_patch_03.ep5.el5
richfaces-framework
Red Hat:jboss_enterprise_application_platform:5::el5
before 0:3.3.1-9.SP3_patch_03.ep5.el5
0:3.3.1-9.SP3_patch_03.ep5.el5
richfaces-root
Red Hat:jboss_enterprise_application_platform:5::el5
before 0:3.3.1-9.SP3_patch_03.ep5.el5
0:3.3.1-9.SP3_patch_03.ep5.el5
richfaces-ui
Red Hat:jboss_enterprise_application_platform:5::el5
before 0:3.3.1-9.SP3_patch_03.ep5.el5
0:3.3.1-9.SP3_patch_03.ep5.el5
richfaces
Red Hat:jboss_enterprise_application_platform:5::el6
before 0:3.3.1-6.SP3_patch_03.ep5.el6
0:3.3.1-6.SP3_patch_03.ep5.el6
richfaces-demo
Red Hat:jboss_enterprise_application_platform:5::el6
before 0:3.3.1-6.SP3_patch_03.ep5.el6
0:3.3.1-6.SP3_patch_03.ep5.el6
richfaces-framework
Red Hat:jboss_enterprise_application_platform:5::el6
before 0:3.3.1-6.SP3_patch_03.ep5.el6
0:3.3.1-6.SP3_patch_03.ep5.el6
richfaces-root
Red Hat:jboss_enterprise_application_platform:5::el6
before 0:3.3.1-6.SP3_patch_03.ep5.el6
0:3.3.1-6.SP3_patch_03.ep5.el6
richfaces-ui
Red Hat:jboss_enterprise_application_platform:5::el6
before 0:3.3.1-6.SP3_patch_03.ep5.el6
0:3.3.1-6.SP3_patch_03.ep5.el6

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubnareshmail/cve-2018-146672018-11-18
PoC in GitHubzeroto01/CVE-2018-146672018-11-23
PoC in GitHubr00t4dm/CVE-2018-146672018-11-28
PoC in GitHubsyriusbughunt/CVE-2018-146672018-11-30
PoC in GitHubquandqn/cve-2018-146672019-07-29
PoC in GitHubVenscor/CVE-2018-14667-poc2019-09-23
PoC in GitHubr4ch1d0/CVE-2018-14667_Lab_POC2026-08-31

What each source reports

CVE List Score used9.8

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Record
CVE-2018-14667
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2022-43079.8

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Record
EUVD-2022-4307
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-j7mw-7crr-658v9.8

Richfaces vulnerable to arbitrary code execution

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Record
GHSA-j7mw-7crr-658v
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-94
Updated
2026-11-02
CISA KEVNo score

Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability

Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Record
CVE-2018-14667
Weakness
CWE-94
Updated
2026-11-02
NVD9.8

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Record
CVE-2018-14667
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-94
Updated
2026-11-02
OSVGHSA-j7mw-7crr-658v9.8

Richfaces vulnerable to arbitrary code execution

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Record
GHSA-j7mw-7crr-658v
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-94
Updated
2026-11-02
OSVRHSA-2018:35179.8

Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 security update

Record
RHSA-2018:3517
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 15 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open