JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Richfaces | Redhat | 3.1.0 (including) | 3.3.4 (including) |
| Red Hat JBoss EAP 5 | RedHat | RichFaces | * |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 | RedHat | richfaces-0:3.3.1-7.SP3_patch_02.ep5.el5 | * |
| Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 | RedHat | richfaces-0:3.3.1-4.SP3_patch_02.ep5.el6_10 | * |
| Red Hat JBoss Operations Network 3.3 | RedHat | RichFaces | * |