com.liferay.faces.demo:com.liferay.faces.demo.richfaces.applicant.portlet (>=3.0.0, <=4.1.2), com.liferay.faces.demos:richfaces4-portlet (4.2.5-ga6) +13 more potentially affected by CVE-2018-12532 via org.richfaces:richfaces-core (>=4.5.3.final, <=4.5.17.final)

org.richfaces:richfaces-core MAVEN version =4.5.3.final, =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =3.0.0, =1.5, =4.5.3.final, =4.5.17.final Source cves: CVE-2018-12532 Source advisory: OSV:GHSA-3HX6-FQPJ-XFJR...

CVE-2018-12532

JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language EL variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309...

CVE-2018-12532

JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language EL variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309...

CVE-2018-12532

JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language EL variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309...

CVE-2018-12532

CVE-2018-12532 affects JBoss RichFaces 4.5.3 through 4.5.17. It allows unauthenticated remote attackers to inject an arbitrary Expression Language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource’s resource request (RF-14309). This is a server-side code execution ris...

CVE-2018-12532

JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language EL variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309...