{"id":"CVE-2018-14667","aliases":["EUVD-2022-4307","GHSA-j7mw-7crr-658v","RHSA-2018:3517"],"status":"published","title":"Richfaces vulnerable to arbitrary code execution","description":"The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.74202,"percentile":0.9949,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2018-11-06T22:00:00Z","modified":"2026-06-17T01:41:24Z","kev":{"date_added":"2023-09-28","due_date":"2023-10-19","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2023-09-28"},{"source":"kev","since":"2023-09-28"}],"exploits":[{"source":"pocgithub","id":"nareshmail/cve-2018-14667","title":"nareshmail/cve-2018-14667","date":"2018-11-18","url":"https://github.com/nareshmail/cve-2018-14667"},{"source":"pocgithub","id":"zeroto01/CVE-2018-14667","title":"zeroto01/CVE-2018-14667","date":"2018-11-23","url":"https://github.com/zeroto01/CVE-2018-14667"},{"source":"pocgithub","id":"r00t4dm/CVE-2018-14667","title":"r00t4dm/CVE-2018-14667","date":"2018-11-28","url":"https://github.com/r00t4dm/CVE-2018-14667"},{"source":"pocgithub","id":"syriusbughunt/CVE-2018-14667","title":"syriusbughunt/CVE-2018-14667","date":"2018-11-30","url":"https://github.com/syriusbughunt/CVE-2018-14667"},{"source":"pocgithub","id":"quandqn/cve-2018-14667","title":"quandqn/cve-2018-14667","date":"2019-07-29","url":"https://github.com/quandqn/cve-2018-14667"},{"source":"pocgithub","id":"Venscor/CVE-2018-14667-poc","title":"Venscor/CVE-2018-14667-poc","date":"2019-09-23","url":"https://github.com/Venscor/CVE-2018-14667-poc"},{"source":"pocgithub","id":"r4ch1d0/CVE-2018-14667_Lab_POC","title":"r4ch1d0/CVE-2018-14667_Lab_POC","date":"2026-08-31","url":"https://github.com/r4ch1d0/CVE-2018-14667_Lab_POC"}],"fixes":[{"ecosystem":"Maven","package":"org.richfaces:richfaces-core","fixed_in":["3.3.4"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces","fixed_in":["0:3.3.1-9.SP3_patch_03.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-cdk","fixed_in":["0:3.3.1-9.SP3_patch_03.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-demo","fixed_in":["0:3.3.1-9.SP3_patch_03.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-docs","fixed_in":["0:3.3.1-9.SP3_patch_03.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-framework","fixed_in":["0:3.3.1-9.SP3_patch_03.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-root","fixed_in":["0:3.3.1-9.SP3_patch_03.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-ui","fixed_in":["0:3.3.1-9.SP3_patch_03.ep5.el5"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces","fixed_in":["0:3.3.1-6.SP3_patch_03.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces-demo","fixed_in":["0:3.3.1-6.SP3_patch_03.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces-framework","fixed_in":["0:3.3.1-6.SP3_patch_03.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces-root","fixed_in":["0:3.3.1-6.SP3_patch_03.ep5.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces-ui","fixed_in":["0:3.3.1-6.SP3_patch_03.ep5.el6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.richfaces:richfaces-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.richfaces:richfaces-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-9.SP3_patch_03.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-cdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-9.SP3_patch_03.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-9.SP3_patch_03.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-9.SP3_patch_03.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-9.SP3_patch_03.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-root","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-9.SP3_patch_03.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","package":"richfaces-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-9.SP3_patch_03.ep5.el5"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-6.SP3_patch_03.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-6.SP3_patch_03.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-6.SP3_patch_03.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces-root","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-6.SP3_patch_03.ep5.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","package":"richfaces-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-6.SP3_patch_03.ep5.el6"}]}]}],"products":[{"vendor":"[unknown]","product":"richfaces"},{"vendor":"red hat","product":"jboss richfaces framework"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"richfaces"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3519","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3581","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3518","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3517","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","web","advisory"]},{"url":"http://www.securitytracker.com/id/1042037","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","web"]},{"url":"http://seclists.org/fulldisclosure/2020/Mar/21","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14667","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14667","tags":["advisory"]},{"url":"https://github.com/richfaces/richfaces/commit/1372eb716c1a215a5af124198f21bde33fafad06","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j7mw-7crr-658v"},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://access.redhat.com/solutions/3660371","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/5/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1639139","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1640767","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3517.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14667","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14667","tags":["advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2018-14667","description":"The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.","status":"published","published":"2018-11-06T22:00:00Z","modified":"2025-10-21T23:45:47.44Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:00.948726Z"}],"euvd":[{"id":"EUVD-2022-4307","description":"The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.","status":"published","published":"2018-11-06T22:00:00Z","modified":"2025-10-21T23:45:47Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2023-09-28","updated_at":"2026-11-02T20:31:24.172282Z"}],"ghsa":[{"id":"GHSA-j7mw-7crr-658v","title":"Richfaces vulnerable to arbitrary code execution","description":"The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via `org.ajax4jsf.resource.UserResource$UriData`.","status":"published","published":"2022-05-13T01:17:53Z","modified":"2025-10-22T17:36:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2018-14667","title":"Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability","description":"Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.","cwes":["CWE-94"],"kev":{"date_added":"2023-09-28","due_date":"2023-10-19","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2018-14667","description":"The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.","status":"published","published":"2018-11-06T22:29:00.193Z","modified":"2026-06-17T01:41:24.937Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:04:47.196456Z"}],"osv":[{"id":"GHSA-j7mw-7crr-658v","title":"Richfaces vulnerable to arbitrary code execution","description":"The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via `org.ajax4jsf.resource.UserResource$UriData`.","status":"published","published":"2022-05-13T01:17:53Z","modified":"2025-10-22T17:36:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"RHSA-2018:3517","title":"Red Hat Security Advisory: JBoss Enterprise Application Platform 5.2.0 security update","status":"published","published":"2024-09-16T01:48:56Z","modified":"2025-11-22T11:36:39Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:05.383061Z"}]}}