JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL)…
Priority LOW 37CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Partial Red Hat: 1 fixed, 4 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-94.
Summary
JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.
Why it matters now
EPSS 0.03929 90th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
Red Hat 1 advisory
- RHSA-2015:0719 Released 2015-03-24 · Red Hat rating ImportantRed Hat JBoss Web Framework Kit 2.7.0 security update
- Red Hat JBoss Web Framework Kit 2.7
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Operations Network 3 | Affected | No fix yet |
| Red Hat JBoss Portal 5 | Affected | No fix yet |
| Red Hat JBoss Portal 6 | Affected | No fix yet |
| Red Hat JBoss SOA Platform 5 | Affected | No fix yet |
| Red Hat JBoss Web Framework Kit 2.7 | Fixed | RHSA-2015:0719 |
Not affected: 3 products
- Red Hat JBoss Data Grid 6
- Red Hat JBoss Enterprise Application Platform 5
- Red Hat JBoss Enterprise Application Platform 6
Timeline
- 2026-10-02 Threatist record created from CVE-2015-0279
- 2026-10-03 Alias added: GHSA-8cc3-p77g-5pcc
References
Advisory 4
Other 4
- 20190723 Tufin SecureChange uses Richfaces 4.3.5, vulnerable to CVE-2015-0279 (unauthenticated RCE)
- http://packetstormsecurity.com/files/153734/Tufin-Secure-Change-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html
- 20200313 RichFaces exploitation toolkit
More Red Hat Richfaces vulnerabilities
- TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
- TI-2018-08993 JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject… CVSS 3.0CRITICAL 9.8
- TI-2018-08992 JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an… CVSS 3.0CRITICAL 9.8
- TI-2013-01934 ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss… CVSS 2.0HIGH 7.5
- TI-2014-00081 The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2015-0279 · CVE Program
- CVE-2015-0279 · NVD
- FIRST EPSS
- GHSA-8cc3-p77g-5pcc · GitHub Advisory Database · CC BY 4.0
- CVE-2015-0279 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences