Login Request a demo
Unscored severity · published Mar 26, 2015
CVE-2015-0279
JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter
–
CVSS
3.9%
EPSS
No
On KEV
Description
JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RI
Richfaces · Redhat
4.0.0 through 4.5.4 · source: NVD
Affected product
RI
Richfaces
Redhat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0279
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0279
Third Party Advisory
http://jvn.jp/en/jp/JVN56297719/index.html
Third Party Advisory
http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-001959.html
packetstormsecurity.com
http://packetstormsecurity.com/files/153734/Tufin-Secure-Change-Remote-Code-Execution.html
packetstormsecurity.com
http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html
Broken Link
http://rhn.redhat.com/errata/RHSA-2015-0719.html
seclists.org
http://seclists.org/fulldisclosure/2019/Jul/21
More from Richfaces
9.8
CVE-2018-14667
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource
9.8
CVE-2018-12533
JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring…
9.8
CVE-2018-12532
JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a…
–
CVE-2014-0086
The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and…
–
CVE-2013-2165
ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss…