| Package | Affected versions | Patched versions |
|---|---|---|
| org.richfaces:richfaces-core | ≥ 3.1.0, ≤ 3.3.4 | |
| richfaces | ≥ 3.1.0, ≤ 3.3.4 |
JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free