Vulnerability · Published Sep 2, 2022 · Assigned by apache
CVE-2022-29158Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz
High 7.5
In plain English
A high-severity regular-expression denial of service in Apache OFBiz from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)2.2%top 17.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache OFBiz | Apache OFBiz – through 18.12.05 |
Weakness: CWE-1333
References
- https://lists.apache.org/thread/7k92rg1o4ql2yw3o0vttkcl2jhq7j928 x_refsource_MISC
- [oss-security] 20220902 Apache OFBiz - Regular Expression Denial of Service (ReDoS) (CVE-2022-29158) mailing-list, x_refsource_MLIST