What is CVE-2015-0279?

CVE-2015-0279 is a vulnerability in Redhat Richfaces, classified under Code Injection. Published 2015-03-26.

Is CVE-2015-0279 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Redhat Richfaces

CVE-2015-0279

JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.039 (89.2th percentile) — read the EPSS interpretation.

Affected products

Redhat Richfaces
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

Public proof-of-concept exploits

References

secalert@redhat.com (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Broken Link, Vendor Advisory)
secalert@redhat.com (VDB Entry, Third Party Advisory, x_refsource_JVN, third-party-advisory)
secalert@redhat.com (x_refsource_JVNDB, VDB Entry, Third Party Advisory, third-party-advisory)
secalert@redhat.com (mailing-list, x_refsource_FULLDISC)
secalert@redhat.com (x_refsource_MISC)
secalert@redhat.com (x_refsource_MISC)
secalert@redhat.com (mailing-list, x_refsource_FULLDISC)

Frequently asked questions

What is CVE-2015-0279?: CVE-2015-0279 is a vulnerability in Redhat Richfaces, classified under Code Injection. Published 2015-03-26.
Is CVE-2015-0279 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.