CVE-2015-0279

JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

3.93% chance of exploitation in the next 30 days, 90th percentile

Published

2015-03-26

Updated

2024-08-06

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/156663/Richsploit-RichFaces-Exploitation-Toolkit.html
• http://seclists.org/fulldisclosure/2020/Mar/21

References

• CVE Record
• NVD entry

Related

• CVE-2015-0273
• CVE-2015-0311
• CVE-2015-0258
• CVE-2015-0313
• CVE-2015-0252
• CVE-2015-0318