Executive Summary
CISA has added a new vulnerability, CVE-2018-14667, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation.
The vulnerability is related to the Red Hat JBoss RichFaces Framework and has a CVSS Score of 9.8. Organizations using impacted platforms are urged to update as the vulnerability has been observed to be exploited.
Vulnerability and Fixes
The CVE-2018-14667 vulnerability in the Red Hat JBoss RichFaces Framework allows for expression language injection via the UserResource resource.
A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects.
Vulnerability Information in the Known Exploited Vulnerabilities Catalog:
Description: Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due Date: 2023-10-19
Based on RedHat security advisory, here is the list of S/W impacted along with the fixes:
Further information can be found in the RedHat security advisory.
⚠️ The vulnerability has been detected in 2018 and Red Hat has provided patches and mitigation instructions for the affected software. Organizations using impacted platforms are urged to follow the instructions in the Red Hat security advisory!
CISA’s Known Exploited Vulnerabilities Catalog
CISA’s Known Exploited Vulnerabilities Catalog is a living list of known Common Vulnerabilities and Exposures (CVEs) that pose significant risks to the federal enterprise.
It was established through Binding Operational Directive (BOD) 22-01, which requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities to protect their networks against active threats.
While the directive applies to FCEB agencies, CISA strongly urges all organizations to prioritize timely remediation of catalog vulnerabilities as part of their vulnerability management practice.
The catalog is continuously updated with new vulnerabilities that meet the specified criteria.
