Remote Code Execution Through Deserialization Attack

2019-01-1508:55:59

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.1 Low

EPSS

Percentile

94.9%

JSON

RichFaces is vulnerable to remote code execution through deserialization attacks. The ResourceBuilderImpl.java class in RichFaces does not restrict the classes which can be deserialized, allowing remote attackers to execute code.

CPENameOperatorVersion
richfaceseq3.3.1__1.SP3.ep5.el4
richfaceseq3.3.1__1.SP3.ep5.el5
richfaceseq3.3.1__1.SP3.1.ep5.el6
richfaceseq3.3.0__1.24.ep5.el4
richfaceseq3.3.0__1.24.ep5.el5
jboss-seam2eq2.0.2.FP_SEC1__1.ep2.4.el4
jboss-seam2eq2.0.2.FP_SEC1__1.ep2.3.el5
richfaceseq3.3.1__1.SP3.ep5.el4
richfaceseq3.3.1__1.SP3.ep5.el5
richfaceseq3.3.1__1.SP3.1.ep5.el6

Name	Operator	Version
richfaces	eq	3.3.1__1.SP3.ep5.el4
richfaces	eq	3.3.1__1.SP3.ep5.el5
richfaces	eq	3.3.1__1.SP3.1.ep5.el6
richfaces	eq	3.3.0__1.24.ep5.el4
richfaces	eq	3.3.0__1.24.ep5.el5
jboss-seam2	eq	2.0.2.FP_SEC1__1.ep2.4.el4
jboss-seam2	eq	2.0.2.FP_SEC1__1.ep2.3.el5
richfaces	eq	3.3.1__1.SP3.ep5.el4
richfaces	eq	3.3.1__1.SP3.ep5.el5
richfaces	eq	3.3.1__1.SP3.1.ep5.el6