{"action":"Upgrade org.richfaces:richfaces-core to 3.3.4 or later.","affected":[{"fixed":"3.3.4","introduced":"0"}],"component":"org.richfaces:richfaces-core","cve_ids":["CVE-2018-14667"],"ecosystem":"Maven","epss":0.74202,"exploited":true,"fixed_versions":["3.3.4"],"ghsa_id":"GHSA-j7mw-7crr-658v","id":"tcs_01M5N92A61V6XQ3VGP28M6P0QE","modified_at":"2025-10-22T17:36:28Z","published_at":"2022-05-13T01:17:53Z","references":["https://osv.dev/vulnerability/GHSA-j7mw-7crr-658v","https://nvd.nist.gov/vuln/detail/CVE-2018-14667","https://github.com/richfaces/richfaces/commit/1372eb716c1a215a5af124198f21bde33fafad06","https://access.redhat.com/errata/RHSA-2018:3517","https://access.redhat.com/errata/RHSA-2018:3518","https://access.redhat.com/errata/RHSA-2018:3519","https://access.redhat.com/errata/RHSA-2018:3581","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-14667","http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html","http://seclists.org/fulldisclosure/2020/Mar/21"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-j7mw-7crr-658v","url":"https://osv.dev/vulnerability/GHSA-j7mw-7crr-658v"},{"source":"kev","source_id":"CVE-2018-14667","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"Richfaces vulnerable to arbitrary code execution"}