CVE-2018-14667
Red Hat JBoss RichFaces Framework
Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
What it is
Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor notices and references
Description and required action as published by CISA. Full record at NVD.
Other Red Hat entries on the list
- Automatic Bug Reporting Tool Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability CVE-2015-5287 · Aug 26, 2026
- Libuser Red Hat Libuser Race Condition Vulnerability CVE-2015-3246 · Aug 26, 2026
- Polkit Red Hat Polkit Incorrect Authorization Vulnerability CVE-2021-3560 · May 12, 2023
- Polkit Red Hat Polkit Out-of-Bounds Read and Write Vulnerability CVE-2021-4034 · Jun 27, 2022
- JBoss Red Hat JBoss Information Disclosure Vulnerability CVE-2010-1428 · May 25, 2022
- JBoss Red Hat JBoss Authentication Bypass Vulnerability CVE-2010-0738 · May 25, 2022