CVE-2015-0279

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN56297719/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-001959.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/153734/Tufin-Secure-Change-Remote-Code-Execution.html
http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html
http://rhn.redhat.com/errata/RHSA-2015-0719.htmlBroken Link, Vendor Advisory
http://seclists.org/fulldisclosure/2019/Jul/21
http://seclists.org/fulldisclosure/2020/Mar/21
https://bugzilla.redhat.com/show_bug.cgi?id=1192140Issue Tracking, Vendor Advisory
http://jvn.jp/en/jp/JVN56297719/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-001959.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/153734/Tufin-Secure-Change-Remote-Code-Execution.html
http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html
http://rhn.redhat.com/errata/RHSA-2015-0719.htmlBroken Link, Vendor Advisory
http://seclists.org/fulldisclosure/2019/Jul/21
http://seclists.org/fulldisclosure/2020/Mar/21
https://bugzilla.redhat.com/show_bug.cgi?id=1192140Issue Tracking, Vendor Advisory

Timeline

Published: Mar 26, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-02825.0GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allow CVE-2015-02837.8The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to caus CVE-2015-02845.4Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to injec CVE-2015-02854.3The ssl3_client_hello function in s3_clnt.c in OpenSSL 1.0.2 before 1.0.2a does not ensure that the PRNG is seeded before proceeding with a CVE-2015-02865.0The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0 CVE-2015-02875.0The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 befor CVE-2015-02885.0The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 befor CVE-2015-02895.0The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly han CVE-2015-02905.0The multi-block feature in the ssl3_write_bytes function in s3_pkt.c in OpenSSL 1.0.2 before 1.0.2a on 64-bit x86 platforms with AES NI supp CVE-2015-02915.0The sigalgs implementation in t1_lib.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (NULL pointer der CVE-2015-02927.5Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1 CVE-2015-02935.0The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attacker