Description

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.

Remediation

References

https://codewhitesec.blogspot.com/2018/05/poor-richfaces.html

http://www.securityfocus.com/bid/104502

https://access.redhat.com/errata/RHSA-2018:2664

https://access.redhat.com/errata/RHSA-2018:2663

http://www.securitytracker.com/id/1041617

https://access.redhat.com/errata/RHSA-2018:2930

http://seclists.org/fulldisclosure/2020/Mar/21

Related Vulnerabilities

CVE-2023-36542 Vulnerability in maven package org.apache.nifi:nifi-jms-processors

CVE-2022-29166 Vulnerability in npm package matrix-org-irc

CVE-2016-10520 Vulnerability in npm package jadedown

CVE-2022-21802 Vulnerability in npm package grapesjs

CVE-2021-33420 Vulnerability in npm package replicator

Severity

Critical

Classification

CWE-917 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory VDB Entry