CVE-2018-12532

PoC —

CVSS 3.0

9.8 critical

EPSS

7%p94

Published

Jun 18, 2018 (Jun 18, 2018)

Modified

Jun 17, 2026

Description

JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309.

Vendors: redhat
Products: richfaces
Weakness: CWE-917
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (7.0%)

In the news0 stories

No ingested article mentions this CVE yet.