CVSS 3.0
9.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2018-12532
Critical (9.8) in redhat richfaces. EPSS 6.8% chance of exploitation in the next 30 days.
JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309.
Severity
- EPSS
- 6.8% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-917
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:richfaces
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3hx6-fqpj-xfjr | Maven | org.richfaces:richfaces-core | >=4.5.3.Final <=4.5.17.Final | no fix published |