Vulnerabilities > CVE-2018-12533 - Expression Language Injection vulnerability in Redhat Richfaces
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
| NASL family | Red Hat Local Security Checks |
| NASL id | REDHAT-RHSA-2018-2664.NASL |
| description | A security update is now available for Red Hat JBoss Enterprise Application Platform from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Enterprise Application Platform 5.2 is a platform for Java applications based on jbossas. This asynchronous patch is a security update for RichFaces and Apache CXF packages in Red Hat JBoss Enterprise Application Platform 5.2. Security Fix(es) : * Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource. (CVE-2018-12533) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 117398 |
| published | 2018-09-10 |
| reporter | This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/117398 |
| title | RHEL 5 / 6 : JBoss EAP (RHSA-2018:2664) |
Redhat
| advisories |
| ||||||||||||
| rpms |
|
References
- http://seclists.org/fulldisclosure/2020/Mar/21
- http://www.securityfocus.com/bid/104502
- http://www.securitytracker.com/id/1041617
- https://access.redhat.com/errata/RHSA-2018:2663
- https://access.redhat.com/errata/RHSA-2018:2664
- https://access.redhat.com/errata/RHSA-2018:2930
- https://codewhitesec.blogspot.com/2018/05/poor-richfaces.html