Vulnerability · Published Sep 2, 2022 · Assigned by apache

CVE-2022-29063Java Deserialization via RMI Connection from the Solr plugin of Apache OFBiz

Critical 9.8

In plain English

A critical-severity unsafe deserialization in Apache OFBiz from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.1% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)5.1%top 7.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099. In version 18.12.05 and earlier, by hosting a malicious RMI server on localhost, an attacker may exploit this behavior, at server start-up or on a server restart, in order to run arbitrary code. Upgrade to at least 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12646.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache OFBiz	Apache OFBiz – through 18.12.05

Weakness: CWE-502

References

https://lists.apache.org/thread/ytzrjc16pf357zntwk8tjby13kbx9105 x_refsource_MISC
[oss-security] 20220902 Apache OFBiz - Java Deserialization via RMI Connection (CVE-2022-29063) mailing-list, x_refsource_MLIST