Known Exploited Vulnerability - Red Hat JBoss RichFaces Framework Expression Language Injection - 20231002005

Overview

CISA has added CVE-2018-14667 to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

What is the vulnerability?

• CVE-2018-14667 - CVSS v3 Base Score: 9.8: The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

What is vulnerable?

The vulnerability affects the following products:

• Red Hat JBoss RichFaces Framework versions 3.X to 3.3.4

Recommendation

The WA SOC recommends administrators apply the latest patches to all affected devices within expected timeframe of 48 Hours... (refer Patch Management).