CVE-2018-14667

Red Hat JBoss RichFaces Framework — Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
🔥 CVSS 3.1  9.8 / 10 — CRITICAL 🔴 CISA Known Exploited Vulnerability

Overview

Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667; https://nvd.nist.gov/vuln/detail/CVE-2018-14667

Key Details

PropertyValue
CVE ID CVE-2018-14667
Vendor / Product Red Hat — JBoss RichFaces Framework
NVD Published2018-11-06
NVD Last Modified2025-11-03
CVSS 3.1 Score9.8
CVSS 3.1 VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SeverityCRITICAL
CWE CWE-94
CISA KEV Added2023-09-28
CISA KEV Deadline2023-10-19
Known Ransomware Use No

CVSS 3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Required Action

CISA BOD 22-01 Deadline: 2023-10-19. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Timeline

DateEvent
2023-09-28Added to CISA Known Exploited Vulnerabilities catalog
2023-10-19CISA BOD 22-01 remediation deadline

References

ResourceType
NVD — CVE-2018-14667 Vulnerability Database
CISA KEV Catalog Entry US Government