CVE-2018-14667

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
[UNKNOWN]	RichFaces	affected 3.X through 3.3.4

References

http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Mar/21Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1042037Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:3517Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3518Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3519Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3581Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667Issue Tracking, Vendor Advisory
http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Mar/21Mailing List, Third Party Advisory
http://www.securitytracker.com/id/1042037Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:3517Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3518Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3519Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3581Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667Issue Tracking, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14667US Government Resource

Timeline

Published: Nov 6, 2018
Last modified: Jun 17, 2026
Added to CISA KEV: Sep 28, 2023
NVD status: Analyzed

Related CVEs from 2018

CVE-2018-146688.8In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which CVE-2018-146697.5ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database CVE-2018-14677.5The IBM Storwize V7000 Unified management Web interface 1.6 exposes internal cluster details to unauthenticated users. IBM X-Force ID: 14039 CVE-2018-146709.8Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.CVE-2018-146719.8In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vu CVE-2018-146725.3In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messag CVE-2018-146787.8An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x8 CVE-2018-146796.5An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL chunk number validi CVE-2018-14684.3IBM API Connect 5.0.8.1 and 5.0.8.2 could allow a user to get access to internal environment and sensitive API details to which they are not CVE-2018-146806.5An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.CVE-2018-146818.8An issue was discovered in kwajd_read_headers in mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ file header extensions could cause a CVE-2018-146828.8An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the TOLOWER() macro for CHM decompres