CVE-2018-14667The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource.
Updated under an hour ago ()
Does this affect you?
It affects [UNKNOWN] RichFaces and 2 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Sep 28, 2023; federal agencies had to remediate by Oct 19, 2023. Treat that date as your deadline.
Do this next
Free account, 1 product
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
- CVSS
- 9.8 CRITICAL (v3.0, CNA)CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-94
- Known exploited
- Added to CISA KEV Sep 28, 2023; federal remediation due Oct 19, 2023Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- EPSS (exploitation in the next 30 days)
- 74.20% (percentile 99)
- Assigned by
- redhat
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
[UNKNOWN] RichFaces unknown:richfaces (from the name) | affected 3.X through 3.3.4 | CNA record |
redhat richfaces redhat:richfaces | from 3.1.0 through 3.3.4 | NVD |
redhat enterprise_linux redhat:enterprise_linux | 5.0; 6.0 | NVD |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667x-refsource-confirm, issue-tracking, vendor-advisory
- https://access.redhat.com/errata/RHSA-2018:3519vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2018:3581vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2018:3518vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2018:3517vendor-advisory, x-refsource-redhat
- http://www.securitytracker.com/id/1042037vdb-entry, x-refsource-sectrack, third-party-advisory
- http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.htmlx-refsource-misc, third-party-advisory, vdb-entry
- http://seclists.org/fulldisclosure/2020/Mar/21mailing-list, x-refsource-fulldisc, third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14667us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.