Red Hat Security Advisory

RHSA-2018:3517

JBoss Enterprise Application Platform 5.2.0 security update

Released 2018-11-06 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server richfaces-3.3.1-9.SP3_patch_03.ep5.el5, richfaces-cdk-3.3.1-9.SP3_patch_03.ep5.el5, richfaces-demo-3.3.1-9.SP3_patch_03.ep5.el5 +4
Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server richfaces-3.3.1-6.SP3_patch_03.ep5.el6, richfaces-demo-3.3.1-6.SP3_patch_03.ep5.el6, richfaces-framework-3.3.1-6.SP3_patch_03.ep5.el6 +2

TI-2018-10530 CVE-2018-14667 · GHSA-j7mw-7crr-658v

CRITICAL 100KEV

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.74202 Published 2018-11-06 Partial fix · 3.3.4 CWE-94