critical9.8Known exploitedPublic exploit code
CVE-2017-1000486
Primetek Primefaces Remote Code Execution Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-01-10. Federal due date: 2022-07-10.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Primefaces 5.x - Remote Code Execution (Metasploit)2018-01-18 · webapps · java
Impact
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Primetek | Primefaces | from 4.0 through 4.0.24 from 5.0 before 5.2.21 from 5.3 before 5.3.8 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html
- https://cryptosense.com/weak-encryption-flaw-in-primefaces/
- https://github.com/primefaces/primefaces/issues/1152
- https://www.exploit-db.com/exploits/43733/
- http://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html
- https://cryptosense.com/weak-encryption-flaw-in-primefaces/
- https://github.com/primefaces/primefaces/issues/1152
- https://www.exploit-db.com/exploits/43733/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-1000486