Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 28/09/2023. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| org.richfaces:richfaces-core | < 3.3.4 | 3.3.4 |
| richfaces | ≥ 3.1.0, ≤ 3.3.4 |
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free