{"answers":{"affected":"2 open source packages ship an affected version, including org.richfaces:richfaces-core. It affects 2 products.","exploited":"Yes. Attackers have exploited CVE-2018-14667 in the wild since at least 28 Sep 2023.","fix":"Upgrade org.richfaces:richfaces-core to 3.3.4 or later. US federal agencies must fix it by 19 Oct 2023.","what":"CVE-2018-14667 is a critical code injection vulnerability in Redhat Enterprise Linux, published on 6 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2018-14667 and fix it if it is affected.\n\nWhat it is: CVE-2018-14667 is a critical code injection vulnerability in Redhat Enterprise Linux, published on 6 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: Yes. Attackers have exploited CVE-2018-14667 in the wild since at least 28 Sep 2023.\n\nAffected packages and fixed versions:\n- org.richfaces:richfaces-core (Maven): affected all versions; fixed in 3.3.4\n- org.richfaces:richfaces-core (Maven): affected all versions; fixed in 3.3.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2018-14667/ (Markdown: https://insights.sbomify.com/CVE-2018-14667/index.md)","id":"CVE-2018-14667","markdown":"https://insights.sbomify.com/CVE-2018-14667/index.md","name":"CVE-2018-14667","record":{"aliases":["GHSA-j7mw-7crr-658v","RHSA-2018:3517"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Java web framework","requires_auth":"none","summary":"Remote unauthenticated attackers can execute arbitrary code via Expression Language injection in the RichFaces framework.","user_interaction":"not_required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[{"product":"enterprise_linux","vendor":"redhat"},{"product":"richfaces","vendor":"redhat"}],"cvss":{"score":9.8,"severity":"critical","source":"cna","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"description":"The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.","ecosystems":["Maven","Red Hat:jboss_enterprise_application_platform:5::el5","Red Hat:jboss_enterprise_application_platform:5::el6"],"exploits":{"exploitdb":0,"first_seen":"2018-11-18","github_poc":7,"max_poc_stars":50,"metasploit":0,"nuclei":0,"refs":[{"date":"2018-11-30T04:06:08Z","kind":"github_poc","ref":"https://github.com/syriusbughunt/CVE-2018-14667","stars":50,"title":"All about CVE-2018-14667; From what it is to how to successfully exploit it."},{"date":"2019-09-23T07:45:01Z","kind":"github_poc","ref":"https://github.com/Venscor/CVE-2018-14667-poc","stars":8,"title":"CVE-2018-14667-poc Richfaces漏洞环境及PoC"},{"date":"2018-11-23T06:44:49Z","kind":"github_poc","ref":"https://github.com/zeroto01/CVE-2018-14667","stars":2,"title":null},{"date":"2018-11-28T07:35:28Z","kind":"github_poc","ref":"https://github.com/r00t4dm/CVE-2018-14667","stars":1,"title":"about CVE-2018-14667 from RichFaces Framework 3.3.4"},{"date":"2019-07-29T03:22:22Z","kind":"github_poc","ref":"https://github.com/quandqn/cve-2018-14667","stars":1,"title":null},{"date":"2018-11-18T06:43:46Z","kind":"github_poc","ref":"https://github.com/nareshmail/cve-2018-14667","stars":0,"title":"cve-2018-14667 demo"},{"date":"2026-08-31T13:05:14Z","kind":"github_poc","ref":"https://github.com/r4ch1d0/CVE-2018-14667_Lab_POC","stars":0,"title":"Demonstration of the expression language (EL) injection vulnerability CVE-2018-14667 using the photoalbum lab under Jboss application server"}],"tier":"exploited"},"has_fix":true,"headline":"Red Hat JBoss RichFaces Framework Expression Language Injection","id":"CVE-2018-14667","indexable":true,"kev":{"dateAdded":"2023-09-28","dueDate":"2023-10-19","knownRansomwareCampaignUse":"Unknown","product":"JBoss RichFaces Framework","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","vendorProject":"Red Hat","vulnerabilityName":"Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability"},"kind":"cve","links":{"ecosystem":"Maven","product":"redhat:enterprise_linux","products":["redhat:enterprise_linux"],"type":"code_injection","year":"2018"},"n_packages":14,"n_references":8,"next":{"headline":"Server-side request forgery in ClickHouse","id":"CVE-2018-14668"},"packages":[{"ecosystem":"Maven","fixed":["3.3.4"],"introduced":["0"],"last_affected":[],"package":"org.richfaces:richfaces-core","purl":null,"source":"GHSA-j7mw-7crr-658v"},{"ecosystem":"Maven","fixed":["3.3.4"],"introduced":["0"],"last_affected":[],"package":"org.richfaces:richfaces-core","purl":"pkg:maven/org.richfaces/richfaces-core","source":"GHSA-j7mw-7crr-658v"},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","fixed":["0:3.3.1-9.SP3_patch_03.ep5.el5"],"introduced":["0"],"last_affected":[],"package":"richfaces","purl":"pkg:rpm/redhat/richfaces","source":"RHSA-2018:3517"},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","fixed":["0:3.3.1-9.SP3_patch_03.ep5.el5"],"introduced":["0"],"last_affected":[],"package":"richfaces-cdk","purl":"pkg:rpm/redhat/richfaces-cdk","source":"RHSA-2018:3517"},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","fixed":["0:3.3.1-9.SP3_patch_03.ep5.el5"],"introduced":["0"],"last_affected":[],"package":"richfaces-demo","purl":"pkg:rpm/redhat/richfaces-demo","source":"RHSA-2018:3517"},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","fixed":["0:3.3.1-9.SP3_patch_03.ep5.el5"],"introduced":["0"],"last_affected":[],"package":"richfaces-docs","purl":"pkg:rpm/redhat/richfaces-docs","source":"RHSA-2018:3517"},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","fixed":["0:3.3.1-9.SP3_patch_03.ep5.el5"],"introduced":["0"],"last_affected":[],"package":"richfaces-framework","purl":"pkg:rpm/redhat/richfaces-framework","source":"RHSA-2018:3517"},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","fixed":["0:3.3.1-9.SP3_patch_03.ep5.el5"],"introduced":["0"],"last_affected":[],"package":"richfaces-root","purl":"pkg:rpm/redhat/richfaces-root","source":"RHSA-2018:3517"},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el5","fixed":["0:3.3.1-9.SP3_patch_03.ep5.el5"],"introduced":["0"],"last_affected":[],"package":"richfaces-ui","purl":"pkg:rpm/redhat/richfaces-ui","source":"RHSA-2018:3517"},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","fixed":["0:3.3.1-6.SP3_patch_03.ep5.el6"],"introduced":["0"],"last_affected":[],"package":"richfaces","purl":"pkg:rpm/redhat/richfaces","source":"RHSA-2018:3517"},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","fixed":["0:3.3.1-6.SP3_patch_03.ep5.el6"],"introduced":["0"],"last_affected":[],"package":"richfaces-demo","purl":"pkg:rpm/redhat/richfaces-demo","source":"RHSA-2018:3517"},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","fixed":["0:3.3.1-6.SP3_patch_03.ep5.el6"],"introduced":["0"],"last_affected":[],"package":"richfaces-framework","purl":"pkg:rpm/redhat/richfaces-framework","source":"RHSA-2018:3517"},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","fixed":["0:3.3.1-6.SP3_patch_03.ep5.el6"],"introduced":["0"],"last_affected":[],"package":"richfaces-root","purl":"pkg:rpm/redhat/richfaces-root","source":"RHSA-2018:3517"},{"ecosystem":"Red Hat:jboss_enterprise_application_platform:5::el6","fixed":["0:3.3.1-6.SP3_patch_03.ep5.el6"],"introduced":["0"],"last_affected":[],"package":"richfaces-ui","purl":"pkg:rpm/redhat/richfaces-ui","source":"RHSA-2018:3517"}],"prev":{"headline":"Missing authorization in Satellite","id":"CVE-2018-14666"},"products":["RichFaces"],"published":"2018-11-06","related":[{"cvss_score":9.8,"headline":"Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a securit","id":"CVE-2021-20325","kev_date_added":null,"published":"2022-02-18"},{"cvss_score":9.8,"headline":"Memory corruption in libwebp","id":"CVE-2018-25011","kev_date_added":null,"published":"2021-05-21"},{"cvss_score":9.8,"headline":"Other in libwebp","id":"CVE-2018-25014","kev_date_added":null,"published":"2021-05-21"},{"cvss_score":9.8,"headline":"Supply chain in redhat-upgrade-tool","id":"CVE-2014-3585","kev_date_added":null,"published":"2019-11-22"},{"cvss_score":9.3,"headline":"Squid: request/response smuggling in http/1.1 and icap","id":"CVE-2023-46846","kev_date_added":null,"published":"2023-11-03"},{"cvss_score":9.1,"headline":"Memory corruption in libwebp","id":"CVE-2018-25009","kev_date_added":null,"published":"2021-05-21"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"open","licence":"CC0 1.0","name":"CISA KEV"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"yes","exploitation":"active","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-10-21","vendors":["[UNKNOWN]"]},"summary":"Remote unauthenticated attackers can execute arbitrary code via Expression Language injection in the RichFaces framework.","url":"https://insights.sbomify.com/CVE-2018-14667/"}