CVE-2017-1000486

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve@mitre.org

Published

2018-01-03

Last modified

2025-10-21

Known exploited (CISA KEV)

since 2022-01-10, action due 2022-07-10: Apply updates per vendor instructions.

Weaknesses

CWE-326

Affected products

• Primefaces (Primetek)

References

• http://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html
• https://cryptosense.com/weak-encryption-flaw-in-primefaces/
• https://github.com/primefaces/primefaces/issues/1152
• https://www.exploit-db.com/exploits/43733/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-1000486