CVE-2018-14667—Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability

漏洞名称

Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability

描述

Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

已知用于勒索软件活动吗？

勒索软件状态：

Unknown

采集行动

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

其他说明

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667
• https://nvd.nist.gov/vuln/detail/CVE-2018-14667

相关 CWE

• CWE-94