Vulnerabilities > CVE-2018-12533 - Expression Language Injection vulnerability in Redhat Richfaces

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
redhat
CWE-917
critical
nessus
NVD
Published: 2018-06-18
Updated: 2024-11-21

Summary

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.

Vulnerable Configurations

Part Description Count
Application
Redhat
17

Common Weakness Enumeration (CWE)

Nessus

NASL familyRed Hat Local Security Checks
NASL idREDHAT-RHSA-2018-2664.NASL
descriptionA security update is now available for Red Hat JBoss Enterprise Application Platform from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Enterprise Application Platform 5.2 is a platform for Java applications based on jbossas. This asynchronous patch is a security update for RichFaces and Apache CXF packages in Red Hat JBoss Enterprise Application Platform 5.2. Security Fix(es) : * Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource. (CVE-2018-12533) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
last seen2020-06-01
modified2020-06-02
plugin id117398
published2018-09-10
reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/117398
titleRHEL 5 / 6 : JBoss EAP (RHSA-2018:2664)

Redhat

advisories
  • rhsa
    idRHSA-2018:2663
  • rhsa
    idRHSA-2018:2664
  • rhsa
    idRHSA-2018:2930
rpms
  • richfaces-0:3.3.1-4.SP3_patch_02.ep5.el6_10
  • richfaces-0:3.3.1-7.SP3_patch_02.ep5.el5
  • richfaces-cdk-0:3.3.1-7.SP3_patch_02.ep5.el5
  • richfaces-demo-0:3.3.1-4.SP3_patch_02.ep5.el6_10
  • richfaces-demo-0:3.3.1-7.SP3_patch_02.ep5.el5
  • richfaces-docs-0:3.3.1-7.SP3_patch_02.ep5.el5
  • richfaces-framework-0:3.3.1-4.SP3_patch_02.ep5.el6_10
  • richfaces-framework-0:3.3.1-7.SP3_patch_02.ep5.el5
  • richfaces-root-0:3.3.1-4.SP3_patch_02.ep5.el6_10
  • richfaces-root-0:3.3.1-7.SP3_patch_02.ep5.el5
  • richfaces-ui-0:3.3.1-4.SP3_patch_02.ep5.el6_10
  • richfaces-ui-0:3.3.1-7.SP3_patch_02.ep5.el5

References