CVE-2018-12533

—

CVSS 3.0

9.8 critical

EPSS

19%p97

Published

Jun 18, 2018 (Jun 18, 2018)

Modified

Jun 17, 2026

Description

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.

Vendors: redhat
Products: richfaces
Weakness: CWE-917
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (19.0%)

In the news0 stories

No ingested article mentions this CVE yet.