-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.richfaces:richfaces-core | maven | >= 3.1.0, <= 3.3.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from processing user-controlled EL expressions during deserialization of Paint2DResource$ImageData objects. The send() method in Paint2DResource handles resource requests with /DATA/ paths, triggering deserialization. The readObject() method in ImageData (a nested class) executes during deserialization, allowing EL evaluation. Both functions are directly involved in the attack vector described in CVE-2018-12533 and corroborated by Code White's analysis of RF-14310. The Red Hat errata and NVD details confirm the involvement of Paint2DResource in the exploit chain.
A Semantic Attack on Google Gemini - Read the Latest Research