CVE-2018-12533

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-917

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2020/Mar/21
http://www.securityfocus.com/bid/104502Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041617Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:2663Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2664Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2930Third Party Advisory
https://codewhitesec.blogspot.com/2018/05/poor-richfaces.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2020/Mar/21
http://www.securityfocus.com/bid/104502Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041617Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:2663Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2664Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2930Third Party Advisory
https://codewhitesec.blogspot.com/2018/05/poor-richfaces.htmlThird Party Advisory

Timeline

Published: Jun 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-125349.8A SQL injection issue was discovered in the Quick Chat plugin before 4.00 for WordPress.CVE-2018-125365.3In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that do CVE-2018-125375.3In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and lin CVE-2018-125388.8In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSes CVE-2018-125397.8In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM CVE-2018-12546.1RSA Authentication Manager Security Console, versions 8.3 P1 and earlier, contains a reflected cross-site scripting vulnerability. A remote CVE-2018-125408.8In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form p CVE-2018-125416.5In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the h CVE-2018-125429.8In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a rest CVE-2018-125437.5In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is n CVE-2018-125449.8In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense CVE-2018-125457.5In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SET