Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.richfaces:richfaces-core

3 known vulnerabilities (1 critical), with the versions each affects and the releases that fix them.

Latest release
4.5.17.Final (Jun 20, 2016): affected by CVE-2018-12532
Newest unaffected release
4.5.2.Final (Jan 9, 2015)
Advisories
3 · 1 critical
Dependents
13
Releases
23 since 4.5.0.Final (Oct 23, 2014)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2018-14667
    No published release is affected
    No published release is affected
  • CVE-2018-12533
    No published release is affected
    No published release is affected
  • CVE-2018-12532
    Affects 4.5.3.Final to 4.5.17.Final (through the newest release)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • CVE-2018-14667Critical 9.8 · KEV

    The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource.

    Affected: fixed in 3.3.4.

    Fixed in 4.5.0.Final (released Oct 23, 2014, 1475 days before disclosure, the advisory names 3.3.4, which was never published).

    The latest release, 4.5.17.Final, is not affected.

  • JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute…

    Affected: from 3.1.0, through 3.3.4.

    Fixed in 4.5.0.Final (released Oct 23, 2014, 1334 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 4.5.17.Final, is not affected.

  • JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable…

    Affected: from 4.5.3.Final, through 4.5.17.Final.

    No fix released. The latest release, 4.5.17.Final, is still affected.