# org.richfaces:richfaces-core (Maven) vulnerabilities

3 known vulnerabilities (1 critical), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 4.5.17.Final (Jun 20, 2016): affected by CVE-2018-12532
- Newest unaffected release: 4.5.2.Final (Jan 9, 2015)
- Dependents: 13
- Releases: 23 since 4.5.0.Final (Oct 23, 2014)
- Registry: https://central.sonatype.com/artifact/org.richfaces/richfaces-core
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2018-14667: no published release is affected
- CVE-2018-12533: no published release is affected
- CVE-2018-12532: 4.5.3.Final to 4.5.17.Final (through the newest release)

## Advisories (3)

### [CVE-2018-14667](https://cve.now/CVE-2018-14667): The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource.

- Severity: Critical 9.8 · KEV
- Published: Nov 6, 2018
- Affected: fixed in 3.3.4.
- Fixed in 4.5.0.Final (released Oct 23, 2014, 1475 days before disclosure, the advisory names 3.3.4, which was never published).
- The latest release, 4.5.17.Final, is not affected.

### [CVE-2018-12533](https://cve.now/CVE-2018-12533): JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute…

- Severity: Unrated
- Published: Jun 18, 2018
- Affected: from 3.1.0, through 3.3.4.
- Fixed in 4.5.0.Final (released Oct 23, 2014, 1334 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 4.5.17.Final, is not affected.

### [CVE-2018-12532](https://cve.now/CVE-2018-12532): JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable…

- Severity: Unrated
- Published: Jun 18, 2018
- Affected: from 4.5.3.Final, through 4.5.17.Final.
- No fix released. The latest release, 4.5.17.Final, is still affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.richfaces:richfaces-core
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.