CVE-2015-0279

Опубликовано: 24 мар. 2015

Источник: redhat

CVSS2: 6.8

EPSS Низкий

Описание

JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.

It was found that the 'do' parameter permitted expression language (EL) injection, which could allow a remote attacker to execute Java methods on an affected server.

Отчет

This issue did not affect any version of Red Hat JBoss Enterprise Application Platform 5 as they did not include the vulnerable version of the RichFaces component. JBoss EAP 5.x includes versions 3.3.1.x of RichFaces; this vulnerability was introduced in version 4.x of RichFaces.

Затронутые пакеты

Платформа	Пакет	Состояние	Рекомендация	Релиз
Red Hat JBoss Data Grid 6	wildfly	Not affected
Red Hat JBoss Enterprise Application Platform 5	richfaces	Not affected
Red Hat JBoss Enterprise Application Platform 6	wildfly	Not affected
Red Hat JBoss Operations Network 3	wildfly	Affected
Red Hat JBoss Portal 5	richfaces	Affected
Red Hat JBoss Portal 6	richfaces	Affected
Red Hat JBoss SOA Platform 5	widlfly	Affected
Red Hat JBoss Web Framework Kit 2.7		Fixed	RHSA-2015:0719	24.03.2015

Показывать по

Ссылки на источники

Дополнительная информация

Статус:

Important

Дефект:

CWE-95

https://bugzilla.redhat.com/show_bug.cgi?id=1192140RichFaces: Remote Command Execution via insufficient EL parameter sanitization

EPSS

Процентиль: 91%

0.06506

Низкий

6.8 Medium

CVSS2

Связанные уязвимости

CVE-2015-0279

nvd

почти 11 лет назад

JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.

GHSA-8cc3-p77g-5pcc

github

больше 3 лет назад