CVE-2018-12533

high-risk
Published 2018-06-18

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.

Do I need to act?

!
75.5% chance of exploitation in next 30 days
EPSS score — higher than 25% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Redhat

References (14)

http://seclists.org/fulldisclosure/2020/Mar/21
Third Party Advisory http://www.securityfocus.com/bid/104502
Third Party Advisory http://www.securitytracker.com/id/1041617
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2663
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2664
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2930
Third Party Advisory https://codewhitesec.blogspot.com/2018/05/poor-richfaces.html
http://seclists.org/fulldisclosure/2020/Mar/21
Third Party Advisory http://www.securityfocus.com/bid/104502
Third Party Advisory http://www.securitytracker.com/id/1041617
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2663
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2664
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2930
Third Party Advisory https://codewhitesec.blogspot.com/2018/05/poor-richfaces.html
57
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 20/34 · Moderate
Exposure 5/34 · Minimal