Live › vulnerability › CVE-2018-14667
Go to dashboardRed Hat JBoss RichFaces, a Java web UI component library, lets remote attackers inject expression language through its UserResource handler. An unauthenticated attacker can chain serialized Java objects to run arbitrary code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Red Hat JBoss RichFaces Framework | vendor | – | – |
| redhat richfaces | vendor | >= 3.1.0, <= 3.3.4 | – |
| redhat enterprise linux | vendor | = 5.0 | – |
| redhat enterprise linux | vendor | = 6.0 | – |
Unknown from the sources.
Apply the vendor mitigation or remove RichFaces; the sources do not name a fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2018-14667")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.