Is CVE-2018-14667 exploited in the wild?

Yes. CVE-2018-14667 is known to be exploited in the wild, first recorded on 28 September 2023. Treat it as urgent.

How severe is CVE-2018-14667?

Critical severity, with a CVSS score of 3.1, published 13 May 2022.

Which products and versions are affected?

org.richfaces:richfaces-core (Maven) ECOSYSTEM:introduced=0,fixed=3.3.4.

Is there a fix for CVE-2018-14667?

Yes. org.richfaces:richfaces-core (Maven): upgrade to 3.3.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-14667 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2018-14667?

Check whether you run org.richfaces:richfaces-core (Maven) or Red Hat JBoss RichFaces Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-14667: Richfaces vulnerable to arbitrary code execution

CVE-2018-14667 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2022-05-13

Red Hat JBoss RichFaces Framework contains an Expression Language (EL) injection vulnerability in the UserResource component. A remote, unauthenticated attacker can exploit this by sending a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData to execute arbitrary code.

Technologies: org.richfaces:richfaces-core (Maven). Vendors: Maven, Red Hat.

Quick answers

Is CVE-2018-14667 exploited in the wild?: Yes. CVE-2018-14667 is known to be exploited in the wild, first recorded on 28 September 2023. Treat it as urgent.
How severe is CVE-2018-14667?: Critical severity, with a CVSS score of 3.1, published 13 May 2022.
Which products and versions are affected?: org.richfaces:richfaces-core (Maven) ECOSYSTEM:introduced=0,fixed=3.3.4.
Is there a fix for CVE-2018-14667?: Yes. org.richfaces:richfaces-core (Maven): upgrade to 3.3.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-14667 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2018-14667?: Check whether you run org.richfaces:richfaces-core (Maven) or Red Hat JBoss RichFaces Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.richfaces:richfaces-core (Maven): upgrade to 3.3.4 or later

# set org.richfaces:richfaces-core to 3.3.4 in your pom.xml or build.gradle

Affected products

Red Hat RichFaces Framework 3.1.0 through 3.3.4

Identifiers

CVE-2018-14667
GHSA-j7mw-7crr-658v

Timeline

2018-11-06: advisory: Red Hat issued security advisories (RHSA-2018:3517, RHSA-2018:3518, RHSA-2018:3519)
2023-09-28: kev added: Added to CISA Known Exploited Vulnerabilities Catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.