CVE-2015-0279

概要

参考情報

• jvn.jp/en/jp/JVN56297719/index.html · Third Party Advisory
• jvndb.jvn.jp/en/contents/2015/JVNDB-2015-001959.html · Third Party Advisory
• packetstormsecurity.com/files/153734/Tufin-Secure-Change-Remote-Code-Execution.html
• packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html
• rhn.redhat.com/errata/RHSA-2015-0719.html · Broken Link
• seclists.org/fulldisclosure/2019/Jul/21
• seclists.org/fulldisclosure/2020/Mar/21
• bugzilla.redhat.com/show_bug.cgi · Issue Tracking

richfaces のその他の脆弱性

• CVE-2018-14667緊急 9.8悪用確認済み（CISA KEV）The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unaut…
• CVE-2018-12533緊急 9.8JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbit…
• CVE-2018-12532緊急 9.8JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper…
• CVE-2014-0086中 4.3The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of…
• CVE-2013-2165高 7.5ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web …