CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 1CVE-2018-12532
https://notcve.org/view.php?id=CVE-2018-12532
JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309. JBoss RichFaces, de la versión 4.5.3 hasta la 4.5.17, permite que atacantes remotos no autenticados inyecten un mapper de variable de lenguaje de expresión (EL) arbitrario y ejecute código Java arbitrario mediante una petición de recursos a MediaOutputResource. Esto también se conoce como RF-14309. • http://seclists.org/fulldisclosure/2020/Mar/21 http://www.securityfocus.com/bid/104503 https://codewhitesec.blogspot.com/2018/05/poor-richfaces.html • CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •
CVSS: 6.8EPSS: 1%CPEs: 1EXPL: 0CVE-2015-0279 – RichFaces: Remote Command Execution via insufficient EL parameter sanitization
https://notcve.org/view.php?id=CVE-2015-0279
JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter. JBoss RichFaces anterior a 4.5.4 permite a atacantes remotos inyectar expresiones del lenguaje de expresiones (EL) y ejecutar código Java arbitrario a través del parámetro do. It was found that the 'do' parameter permitted expression language (EL) injection, which could allow a remote attacker to execute Java methods on an affected server. • http://jvn.jp/en/jp/JVN56297719/index.html http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-001959.html http://packetstormsecurity.com/files/153734/Tufin-Secure-Change-Remote-Code-Execution.html http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html http://rhn.redhat.com/errata/RHSA-2015-0719.html http://seclists.org/fulldisclosure/2019/Jul/21 http://seclists.org/fulldisclosure/2020/Mar/21 https://bugzilla.redhat.com/show_bug.cgi?id=1192140 https://a • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 1CVE-2014-0086 – RichFaces: remote denial of service via memory exhaustion
https://notcve.org/view.php?id=CVE-2014-0086
The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a large number of malformed atmosphere push requests. La función doFilter en webapp/PushHandlerFilter.java en JBoss RichFaces 4.3.4, 4.3.5 y 5.x permite a atacantes remotos causar una denegación de servicio (consumo de memoria y error de falta de memoria) a través de un número grande de solicitudes atmosphere push malformadas. It was found that certain malformed requests caused RichFaces to leak memory. A remote, unauthenticated attacker could use this flaw to send a large number of malformed requests to a RichFaces application that uses the Atmosphere framework, leading to a denial of service (excessive memory consumption) on the application server. • http://rhn.redhat.com/errata/RHSA-2014-0335.html http://secunia.com/advisories/57053 https://bugzilla.redhat.com/show_bug.cgi?id=1067268 https://github.com/pslegr/core-1/commit/8131f15003f5bec73d475d2b724472e4b87d0757 https://issues.jboss.org/browse/RF-13250 https://access.redhat.com/security/cve/CVE-2014-0086 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 10%CPEs: 99EXPL: 1CVE-2013-2165 – RichFaces: Remote code execution due to insecure deserialization
https://notcve.org/view.php?id=CVE-2013-2165
ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data. ResourceBuilderImpl.java en la implementación de RichFaces 3.x a 5.x en la implementación de Red Hat JBoss Web Framework Kit anterior a 2.3.0, Red Hat JBoss Web Platform a 5.2.0, Red Hat JBoss Enterprise Application Platform a 4.3.0 CP10 y 5.x a la 5.2.0, Red Hat JBoss BRMS hasta la 5.3.1, Red Hat JBoss SOA Platform hasta la 4.3.0 CP05 y 5.x hasta la 5.3.1, Red Hat JBoss Portal hasta la 4.3 CP07 y 5.x hasta 5.2.2, y Red Hat JBoss Operations Network hasta 2.4.2 y 3.x hasta la 3.1.2, no restringe las clases para la deserialización de los métodos que pueden ser invocados, lo que permite a atacantes remotos ejecutar código arbitrario a través de datos serializados. • https://github.com/Pastea/CVE-2013-2165 http://jvn.jp/en/jp/JVN38787103/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2013-000072 http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html http://rhn.redhat.com/errata/RHSA-2013-1041.html http://rhn.redhat.com/errata/RHSA-2013-1042.html http://rhn.redhat.com/errata/RHSA-2013-1043.html http://rhn.redhat.com/errata/RHSA-2013-1044.html http://rhn.redhat.com/errata/RHSA-2013-1045.html http:/ • CWE-264: Permissions, Privileges, and Access Controls CWE-502: Deserialization of Untrusted Data •